(1) Subject to paragraph (2A), the designated competent authority for an OES may serve an enforcement notice upon that OES if the authority has reasonable grounds to believe that the OES has failed to—

• (za)notify it under regulation 8(2);
• (zb)comply with the requirements stipulated in regulation 8A;
• (a)fulfil the security duties under regulation 10(1) and (2);
• (b)notify a NIS incident under regulation 11(1);
• (c)comply with the notification requirements stipulated in regulation 11(3);
• (d)notify an incident as required by regulation 12(9);
• (e)comply with an information notice issued under regulation 15; or
• (f)comply with—
• (i)a direction given under regulation 16(1)(c), or
• (ii)the requirements stipulated in regulation 16(3).

(2) Subject to paragraph (2A), the Information Commissioner may serve an enforcement notice upon a RDSP if the Commissioner has reasonable grounds to believe that the RDSP has failed to—

• (a)fulfil its duties under regulation 12(1) or (2);
• (b)notify an incident under regulation 12(3);
• (c)comply with the notification requirements stipulated in regulation 12(5);
• (d)comply with a direction made by the Information Commissioner under regulation 12(12);
• (da)comply with the requirements stipulated in regulation 14A;
• (e)comply with an information notice issued under regulation 15; or
• (f)comply with—
• (i)a direction given under regulation 16(2)(c), or
• (ii)the requirements stipulated in regulation 16(3).

(2A) Before serving an enforcement notice under paragraph (1) or (2), the relevant competent authority or the Information Commissioner must inform the OES or RDSP, in such form and manner as it considers appropriate having regard to the facts and circumstances of the case, of—

• (a)the alleged failure; and
• (b)how and by when representations may be made in relation to the alleged failure and any related matters.

(2B) When the relevant competent authority or the Information Commissioner informs the OES or RDSP in accordance with paragraph (2A), it may also provide notice of its intention to serve an enforcement notice.

(2C) The relevant competent authority or the Information Commissioner may serve an enforcement notice on the OES or RDSP within a reasonable time, irrespective of whether it has provided any notice in accordance with paragraph (2B), having regard to the facts and circumstances of the case, after it has informed the OES or RDSP in accordance with paragraph (2A).

(2D) The relevant competent authority or the Information Commissioner must have regard to any representations made under paragraph (2A)(b).

(3) An enforcement notice that is served under paragraph (1) or (2) must be in writing and must specify the following—

• (a)the reasons for serving the notice;
• (b)the alleged failure which is the subject of the notice; and
• (c)what steps, if any, must be taken to rectify the alleged failure and the time period during which such steps must be taken;
• (d). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(3A) An OES or RDSP upon whom an enforcement notice has been served under paragraph (1) or (2) must comply with the requirements, if any, of the notice regardless of whether the OES or RDSP has paid any penalty imposed on it under regulation 18.

(4) If the relevant competent authority or Information Commissioner is satisfied that no further action is required, having considered—

• (a)any representations submitted in accordance with paragraph (2A); or
• (b)any steps taken to rectify the alleged failure;

it must inform the OES or the RDSP, as the case may be, in writing, as soon as reasonably practicable.

(5) The OES or RDSP may request reasons for a decision to take no further action under paragraph (4) within 28 days of being informed of that decision.

(6) Upon receipt of a request under paragraph (5), the relevant competent authority or Information Commissioner must provide written reasons for a decision under paragraph (4) within a reasonable time and in any event no later than 28 days.