Where the Commission is satisfied that a data controller or data processor has violated or is likely to violate any requirement under this Act or subsidiary legislation made under this Act, the Commission may make an appropriate compliance order against...

The order made by the Commission under subsection (1) may include a — (a) warning that certain act or omission is likely to be a violation of one or more provisions under this Act or any subsidiary legislation or orders issued under it; (b) requirement t...

An order made under this section shall be in writing and shall specify — (a) the provisions of this Act that the Commission is satisfied the data controller or data processor has violated; (b) specific measures to be taken by the data controller o...