Part 6: Enforcement Section 149: Enforcement notices
Subsection (1) gives the Commissioner the power to issue an enforcement notice which requires a person to take steps or refrain from taking steps specified in the notice for failings or failures set out in subsections (2), (3), (4) and (5).
	Subsection (2) sets out the circumstances (listed in subsection (2)(a) to (e)) in which a controller or processor can be issued with an enforcement notice for failure to comply with provisions in the GDPR or this Act.
	Subsection (3) enables the Commissioner to issue an enforcement notice when a monitoring body (of approved codes of conduct as defined in Article 41 of the GDPR) fails to comply with an obligation under Article 41.
	Subsection (4) sets out the circumstances in which a certification provider can be issued with an enforcement notice. These are where the certification provider does not meet the requirements for accreditation; has failed or is failing to comply with an obligation under Article 42 or 43 of the GDPR; or has failed or is failing to comply with another provision of the GDPR – whether in their capacity as a certification provider or otherwise.
	Subsection (5) enables the Commissioner to issue an enforcement notice against a controller for a failure to comply with regulations under section 137 in respect of charges payable to the Commissioner.
	Subsection (6) limits the requirements that the Commissioner may impose when issuing an enforcement notice under subsection (2), (3) or (5) to those which the Commissioner considers appropriate to remedy the failure committed.
	Subsection (7) limits the requirements that the Commissioner may impose (which might include, but does not have to include, a requirement to remedy the failure), when issuing an enforcement notice under subsection (4) which she considers are appropriate with regard to the failure.
	Subsection (8) provides the Secretary of State with a regulation making power to confer a power on the Commissioner to give an enforcement notice in respect of other failures to comply with the data protection legislation not listed in this section.
	Subsection (9) sets out in more detail the provision that regulations under this section can make.