Protection of Personal Information Act, 2013 (Act No. 4 of 2013)Chapter 10 : Enforcement95. Enforcement notice |
| (1) | If the Regulator, after having considered the recommendation of the Enforcement Committee in terms of section 93, is satisfied that a responsible party has interfered or is interfering with the protection of the personal information of a data subject as referred to in section 73, the Regulator may serve the responsible party with an enforcement notice requiring the responsible party to do either or both of the following: |
| (a) | To take specified steps within a period specified in the notice, or to refrain from taking such steps; or |
| (b) | to stop processing personal information specified in the notice, or to stop processing personal information for a purpose or in a manner specified in the notice within a period specified in the notice. |
| (2) | An enforcement notice must contain— |
| (a) | a statement indicating the nature of the interference with the protection of the personal information of the data subject and the reasons for reaching that conclusion; and |
| (b) | particulars of the rights of appeal conferred by section 97. |
| (3) | Subject to subsection (4), an enforcement notice may not require any of the provisions of the notice to be complied with before the end of the period within which an appeal may be brought against the notice and, if such an appeal is brought, the notice need not be complied with pending the determination or withdrawal of the appeal. |
| (4) | If the Regulator considers that an enforcement notice should be complied with as a matter of urgency it may include in the notice a statement to that effect and a statement of its reasons for reaching that conclusion, and in that event subsection (3) does not apply. |
| (5) | A notice in terms of subsection (4) may not require any of the provisions of the notice to be complied with before the end of a period of three days beginning with the day on which the notice is served. |