# Data Protection Act 2018, Paragraph 7


(1) The Commission may vary a penalty notice by giving written notice (a “penalty variation notice”) to the person to whom it was given.
(2) A penalty variation notice must specify—
(a) the penalty notice concerned, and
(b) how it is varied.
(3) A penalty variation notice may not—
(a) reduce the period for payment of the penalty;
(b) increase the amount of the penalty;
(c) otherwise vary the penalty notice to the detriment of the person to whom it was given.
(4) If—
(a) a penalty variation notice reduces the amount of the penalty, and
(b) when that notice is given, an amount has already been paid that exceeds the amount of the reduced penalty,
the Commission must repay the excess.

---
Source: https://www.legislation.gov.uk/ukpga/2018/12/schedule/16/paragraph/7 (the official version)
Page: https://openlegislation.uk/data-protection-act-2018/schedule-16/paragraph-7
Contains public sector information licensed under the Open Government Licence v3.0. Source: legislation.gov.uk, The National Archives.