Section 9: Enforcement notice

9. Enforcement notice (1) Where the Commissioner is of the opinion that a controller or a processor has contravened, is contravening or is about to contravene this Act, the Commissioner may serve an enforcement notice on him requiring him to take such steps within such period as may be specified in the notice. (2) Notwithstanding subsection (1), where the Commissioner is of the opinion that a person has committed an offence under this Act, he may investigate the matter or cause it to be investigated by an authorised officer. (3) An enforcement notice served under subsection (1) shall – (a) specify the provision of this Act which has been, is being or is likely to be, contravened; (b) specify the measures that shall be taken to remedy or eliminate the situation which makes it likely that a contravention will arise; (c) specify a period which shall not be less than 21 days within which those measures shall be implemented; and (d) state that a right of appeal is available under section 51. (4) On complying with an enforcement notice, the controller or processor, as the case may be, shall, not later than 21 days after compliance, notify – (a) the data subject concerned; and (b) where such compliance materially modifies the data concerned, any person to whom the data was disclosed during the period beginning 12 months before the date of the service of the notice and ending immediately before compliance, of any amendment. (5) Where the Commissioner considers that any provision of the enforcement notice may not be complied with to ensure compliance with this Act, he may vary the notice and, where he does so, he shall give written notice to the person on whom the notice was served. 482 Acts 2017 Acts 2017 483 (6) Any person who, without reasonable excuse, fails or refuses to comply with an enforcement notice shall commit an offence and shall, on conviction, be liable to a fine not exceeding 50, 000 rupees and to imprisonment for a term not exceeding 2 years.