(1) An enforcement notice issued by the Commissioner under section 25 must —
(a) specify any provision of this Act that, in the opinion of the Commissioner, the data controller has contravened or is contravening and the reasons for the Commissioner having formed that opinion; and
(b) subject to subsection (2), inform the data subject of his or her right to appeal to the Court under section 69 against the requirement specified in the notice within 30 days from the service of the notice on him or her.
(2) Subject to subsection (3), the time specified in an enforcement notice for compliance with a requirement specified in the enforcement notice shall not be expressed to expire before the end of the period of 30 days specified in subsection (1)(b) and, if an appeal is brought against the requirement, the requirement need not be complied with, pending the determination or withdrawal of the appeal.
(3) If the Commissioner —
(a) by reason of special circumstances, is of the opinion that a requirement specified in an enforcement notice must be complied with urgently; and
(b) such enforcement notice includes a statement to that effect,
subsections (1)(b) and (2) do not apply in relation to the notice, but the notice must contain a statement of the right of appeal of the applicant under section 69, and must not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.
(4) On compliance by a data controller with a requirement under section 25(2), the data controller shall, as soon as may be and in any event not more than 30 days after such compliance, notify —
(a) the data subject concerned; and
(b) any person, where the Commissioner considers it reasonably practicable to do so, to whom the data were disclosed during the period beginning 12 months before the date of the service of the enforcement notice concerned and ending immediately before such compliance, of the rectification, erasure or statement concerned, if such compliance materially modifies the data concerned.
(5) The Commissioner may cancel an enforcement notice and, if he or she does so, shall notify in writing the person on whom it was served accordingly.