(1) If the Commissioner is of the opinion that a data controller has contravened or is contravening a provision of this Act, other than a provision the contravention of which is an offence, the Commissioner may, by an enforcement notice in writing served on the data controller, require the data controller to take such steps as are specified in the enforcement notice within such time, as is specified in the enforcement notice, to comply with the relevant provision.