Data Protection [No. 3 of 2021 89 42. Research, archiving or statistical purpose 43. Journalistic purpose 44. Processing to be lawful and legitimate PART VIII DUTIES OF DATA CONTROLLER AND DATA PROCESSOR 45. Record of processing activities 46. Data protection impact assessment 47. Security of processing 48. Appointment of data protection officer 49. Notification of security breach 50. Accountability 51. Data retention 52. Duties of data processor 53. Non-disclosure of personal data 54. Joint controllers 55. Offence by data controller 56. Personal data in legal proceedings 57. Notification PART IX RIGHTS OF THE DATA SUBJECT 58. Right of access and notification 59. Right to rectification 60. Right to erasure 61. Right of objection 62. Decision taken on basis of automatic data processing 63. Right to restriction of processing 64. Information when personal data collected directly from data subject 65. Right to data portability 66. Notification obligation 67. Derogation from rights 68. Complaints 69. Appeals