(1) Where the Commissioner is satisfied that a person has failed, or is failing, as described in subsection (2), (3), (4) or (5), the Commissioner may give the person a written notice (an "enforcement notice") which requires the person -
(a) to take steps specified in the notice, or
(b) to refrain from taking steps specified in the notice,
or both (and see also sections 150 and 151).
(2) The first type of failure is where a controller or processor has failed, or is failing, to comply with any of the following -
(a) a provision of Chapter II of the UK GDPR or Chapter 2 of Part 3 or Chapter 2 of Part 4 of this Act (principles of processing);
(b) a provision of Articles 12 to 22 of the UK GDPR or Part 3 or 4 of this Act conferring rights on a data subject;
(c) a provision of Articles 25 to 39 of the UK GDPR or section 64 or 65 of this Act (obligations of controllers and processors);
(d) a requirement to communicate a personal data breach to the Commissioner or a data subject under section
…