# Data Protection Act 2018, Paragraph 5


(1) A penalty notice must contain the following information—
(a) the name and address of the person to whom it is addressed;
(b) details of the notice of intent given to the person;
(c) whether the Commission received oral or written representations in accordance with the notice of intent;
(d) the reasons why the Commission proposes to impose the penalty (see sub-paragraph (2));
(e) the reasons for the amount of the penalty, including any aggravating or mitigating factors that the Commission has taken into account;
(f) details of how the penalty is to be paid;
(g) details of the rights of appeal under section 162;
(h) details of the Commission's enforcement powers under this Schedule.
(2) The information required under sub-paragraph (1)(d) includes—
(a) a description of the circumstances of the failure, and
(b) where the notice is given in respect of a failure described in section 149(2), the nature of the personal data involved in the failure.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/5 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/schedule-16/paragraph-5
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.