Part 6: Enforcement Section 155: Penalty notices
This section gives the Commissioner a power to give a monetary penalty notice requiring a person to pay the Commissioner an amount determined by the Commissioner.
	Subsection (1) sets out the circumstances in which the Commissioner can give a written penalty notice. These are where the Commissioner is satisfied that a person has failed to comply with certain provisions of the GDPR or this Act or has failed to comply with an information notice, assessment notice or an enforcement notice.
	Subsections (2) and (3) deal with the matters to which the Commissioner must have regard when considering deciding whether to give a penalty notice and when determining the amount of the penalty. By virtue of subsection (4), the duty to have regard to these matters does not apply where the fine relates to a failure to comply with regulations under section 137.
	Subsection (5) introduces Schedule 16 which makes further provision about penalty notices.
	Subsection (6) provides the Secretary of State with a regulation-making power that allows the Secretary of State to confer a power on the Commissioner to give a penalty notice for failures to comply with the data protection legislation that are additional to those set out in subsection (1) and to make provision about the maximum amount of penalty (either the standard maximum amount or the higher maximum amount as described in section 157) that may be imposed for such failures.
	Subsection (7) states that regulations under this section are subject to the affirmative resolution procedure and may make provision about the giving of penalty notices and amend other provisions relating to such notices.