No. 3 Data Protection data controller or data processor, as the case may be, under investigation; or (b) where the investigation was done on the authority’s own initiative, the data controller or data processor, as the case may be, under investigation. 45.__(1) where upon conclusion of an investigation under section 44, the authority is satisfied that a data controller or data processor has contravened or is likely to contravene this act, the authority shall issue an appropriate compliance order to the data controller or data processor. (2) the compliance order issued by the authority under subsection (1) may include any of the following— (a) an order requiring the data controller or data processor to comply with a specified provision of this act; (b) a cease and desist order requiring the data controller or data processor to stop or refrain from doing an act which is in contravention of this act; (c) an order requiring the data controller or data processor to pay compensation to a data subject affected by the action or inaction of the data controller or data processor; (d) an order requiring the data controller or data processor to account for the profits made out of the contravention; (e) an order requiring the data controller or data processor to pay an administrative penalty not exceeding k20,000,000; or (f) any other order as the authority may consider just and appropriate. (3) a compliance order issued under this section shall be in writing and shall specify— (a) the provision of the act that the data controller or data processor has contravened or is likely to contravene; (b) the specific measures to be taken by the data controller or data processor to avoid, remedy or eliminate the situation which has resulted, or is likely to result, in the contravention; (c) a period within which any action specified in the order is to be implemented; and (d) the right of the data controller or data processor to seek review of the decision by the high court and the period within which to seek the review. (4) a data controller or data processor who fails to comply with a compliance order other than an order to pay compensation or an 27 compliance orders