An enforcement order made or sanction imposed under subsection (1) shall include —

(a) requiring the data controller or data processor to remedy the violation;

(b) ordering the data controller or data processor to pay compensation to a data subject, who has suffered injury, loss, or harm as a result of a violation;

(c) ordering the data controller or data processor to account for the profits realised from the violation; or

(d) ordering the data controller or data processor to pay a penalty or remedial fee.