Paragraph 5 I1C1
A penalty notice must contain the following information—
the name and address of the person to whom it is addressed;
details of the notice of intent given to the person;
whether the F1Commission received oral or written representations in accordance with the notice of intent;
the reasons why the Commission proposes to impose the penalty (see sub-paragraph (2));
the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commission has taken into account;
details of how the penalty is to be paid;
details of the rights of appeal under section 162;
details of the F2Commission's enforcement powers under this Schedule.
The information required under sub-paragraph (1)(d) includes—
a description of the circumstances of the failure, and
where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.
Annotations
Textual amendments
- F1
Word in Sch. 16 para. 5(1)(c)-(e) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
- F2
Word in Sch. 16 para. 5(1)(h) substituted (30.9.2026) by The Data (Use and Access) Act 2025 (Consequential Amendments and Transitional Provision) Regulations 2026 (S.I. 2026/386), reg. 1(2), Sch. 2 para. 23(2)(3); S.I. 2026/1015, reg. 2(c)
Modifications
- C1
Sch. 16 applied (with modifications) by S.I. 2016/696, Sch. 2 (as substituted (25.5.2018) by Data Protection Act 2018 (c. 12), s. 212(1), Sch. 19 para. 406 (with ss. 117, 209, 210); S.I. 2018/625, reg. 2(1)(g) (with reg. 4))
Commencement
- I1
Sch. 16 para. 5 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)