Personal Data Protection Act GN. NO. 395B (Contd) on that person requiring such person to rectify the failure within such period as may be specified in the notice. (2) An enforcement notice served under subsection (1) shall(a) specify the provision of this Act which has been contravened; (b) specify the measures to be taken to remedy or eliminate the situation that leads to such contravention; (c) specify a period that shall not be less than twenty-one days within which such measures shall be implemented; and (d) state any right to appeal. Notice of penalty 46.-(1) Where the Commission is satisfied that a person has failed or is failing to comply with the enforcement notice issued under section 45, the Commission may issue a penalty notice requiring the person to pay a fine to the Commission of an amount specified in the notice. (2) In deciding whether to give a penalty notice to a person and determining the amount of the penalty, the Commission shall, so far as relevant, have regard to(a) the nature, gravity and duration of the failure; (b) the intentional or negligent character of the failure; (c) any action taken by the data controller or data processor to mitigate the damage suffered by data subjects including technical and organisational measures; (d) any relevant previous failures by the data controller or data processor; (e) the degree of co-operation with the Commission, in order to remedy the failure and mitigate the possible adverse effects of the failure; (f) the categories of personal data affected by the failure; 29