(1) The Commissioner may by written notice (an "assessment notice") require a controller or processor to permit the Commissioner to carry out an assessment of whether the controller or processor has complied or is complying with the data protection legislation.
(2) An assessment notice may require the controller or processor to do any of the following -
(a) permit the Commissioner to enter specified premises;
(b) direct the Commissioner to documents on the premises that are of a specified description;
(c) assist the Commissioner to view information of a specified description that is capable of being viewed using equipment on the premises;
(d) comply with a request from the Commissioner for a copy (in such form as may be requested) of -
(i) the documents to which the Commissioner is directed;
(ii) the information which the Commissioner is assisted to view;
(e) direct the Commissioner to equipment or other material on the premises which is of a specified description;
…