Part 5: Data Protection and Privacy Enforcement Section 98: Power of the Commissioner to require a report
Section 98 makes provision for the Commissioner to require a report on a specified matter when exercising the power under section 146 of the DPA 2018 to give an assessment notice.
	Subsection (1) is self-explanatory.
	Subsection (2) amends section 146 (assessment notices) of the DPA 2018.
	Subsection (2)(a) inserts new subsections (j) and (k) in section 146 subsection (2) of the DPA 2018, enabling the Commissioner to require the controller or processor to make arrangements for an approved person to prepare a report on a specified matter and provide the report to the Commissioner.
	Subsection (2)(b) inserts new section 3A after section 146 subsection (3) in the DPA 2018. This provides that the Commissioner may set out requirements in the assessment notice specifying how the report by the approved person is to be prepared, its content, form and when it is required to be completed by.
	Subsection (2)(c) inserts new section 11A after section 146 subsection (11) in the DPA 2018. This requires the controller or processor to pay the cost for this report, including the approved person’s expenses.
	Subsection (2)(d) adds a definition of an approved person to the terms defined in section 146 subsection (12).
	Subsection (3) amends the DPA 2018 by inserting new section 146(A). This outlines the process for approving the person preparing the report and makes clear that the decision to approve lies with the Commissioner.
	New section 146A(1) is self-explanatory.
	New section 146A(2) provides that the controller or processor is to nominate an approved person to prepare the report and that they are required to do so within the time set out by the Commissioner in the notice.
	New section 146A(3) provides that if the Commissioner is satisfied that the person nominated is suitable, that approval is to be provided to the controller or processor in writing.
	New section 146A(4) sets out the process to be followed if the Commissioner is not satisfied that the person nominated is suitable. In such circumstances, the Commissioner is required to let the controller or processor know by written notice their decision, the reasons for their decision and the person the Commissioner is selecting to prepare the report.
	New section 146A(5) sets out the process if the controller or processor fails to nominate a person to prepare the report in the time specified in the notice. In such circumstances, the Commissioner will decide the person to prepare the report and must notify the controller or processor of that decision by written notice. The controller or processor is required to make arrangements for this and pay any associated costs, as would be the case if they had nominated the approved person.
	New section 146A(6) provides that the controller or processor is required to cooperate with the approved person in the process of preparing the report.
	Subsection (4) of section 98 amends section 155(1) (penalty notices) of the DPA 2018 to allow the Commissioner to give a monetary penalty notice where the Commissioner is satisfied that a person has failed to comply with the duty placed upon the controller or processor under new section 146A(6), to assist the approved person in preparing the report.
	Subsection (5) of section 98 amends section 160(4) (guidance about regulatory action) of the DPA 2018. This requires the Commissioner to include in the statutory guidance the factors the Commissioner will consider in deciding whether to issue an assessment notice requiring the preparation of a report, and the factors the Commissioner may take into account when determining the suitability of a person to prepare the report.