require, by notice in writing, the holder of the certificate to show cause, within 14 days of the notice, why the registration certificate should not be cancelled or its terms and conditions should not be varied 20. Register of controllers and processors (1) There shall be a register of controllers and processors to be known as the Data Protection Register, which shall be kept and maintained by the Commissioner in such form and manner as he may determine. (2) The Commissioner may, at any time, at the request of a controller or processor, in respect of which there is an entry in the register and which has ceased to exist, remove its details from the register. (3) (a) The register shall, at all reasonable times, be available for inspection by any person free of charge. (b) Any person may, on payment of such fee as may be prescribed, obtain from the Commissioner a certified copy of, or of an extract from, any entry in the register. PART IV – OBLIGATIONS ON CONTROLLERS AND PROCESSORS 21. Principles relating to processing of personal data Every controller or processor shall ensure that personal data are –