The Commissioner may by written notice (an "assessment notice") require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
An assessment notice may require the controller or processor to do any of the following—
In subsection (2), references to the Commissioner include references to the Commissioner's officers and staff.
An assessment notice that requires a controller or processor to make arrangements for an approved person to prepare a report may require the arrangements to include specified terms as to—
An assessment notice must, in relation to each requirement imposed by the notice, specify the time or times at which, or period or periods within which, the requirement must be complied with (but see the restrictions in subsections (6) to (9)).
An assessment notice must provide information about—
An assessment notice may not require a person to do anything before the end of the period within which an appeal can be brought against the notice.
If an appeal is brought against an assessment notice, the controller or processor need not comply with a requirement in the notice pending the determination or withdrawal of the appeal.
If an assessment notice—
subsections (6) and (7) do not apply but the notice must not require the controller or processor to comply with the requirement before the end of the period of 7 days beginning when the notice is given.
If an assessment notice—
subsections (6) and (7) do not apply.
The Commissioner may cancel an assessment notice by written notice to the controller or processor to whom it was given.
Where the Commissioner gives an assessment notice to a processor, the Commissioner must, so far as reasonably practicable, give a copy of the notice to each controller for whom the processor processes personal data.
Where the Commissioner gives an assessment notice that requires the controller or processor to make arrangements for an approved person to prepare a report, the controller or processor is liable for the payment of the approved person's remuneration and expenses under the arrangements.
In this section—
"approved person", in relation to a report, means a person approved to prepare the report in accordance with section 146A;
"domestic premises" means premises, or a part of premises, used as a dwelling;
"specified" means specified in an assessment notice.