shall be bound to produce before the Inquiry Officer directed to make the inquiry, all such books, registers, documents, records and any data in their custody or power and to furnish to the Inquiry Officer any statement and information relating to the affairs of the data fiduciary or data processor as the Inquiry Officer may require within such time as the said Inquiry Officer may specify. 65. (6) The Inquiry Officer shall undertake the inquiry only after providing a written notice to the persons referred to in sub-section (5) stating the reasons for the inquiry and the relationship between the data fiduciary and the scope of the inquiry. (7) The Inquiry Officer may keep in its custody any books, registers, documents, records and other data produced under sub-section (5) for six months and thereafter shall return the same to the person by whom or on whose behalf such books, registers, documents, record and data are produced, unless an approval to retain such books, registers, documents, record and data for an additional period not exceeding three months has been obtained from the Authority. (8) Without prejudice to any other power set out in this Act or under any other law, any Inquiry Officer directed to make an inquiry may examine on oath, any officer, employee or other person acting under the direct authority of the data fiduciary or the data processor, or a service provider, or a contractor where services are being obtained by or provided to the data fiduciary or data processor, as the case may be, in relation to the business or activity of the data fiduciary or data processor. Action to be taken by Authority pursuant to an inquiry.— (1) On receipt of a report under sub-section (2) of section 64, the Authority may, after giving such opportunity to the data fiduciaryor data processor to make a representation in connection with the report as the Authority deems reasonable, by an order in writing— (a) (b) (c) (d) (e) (f) (g) (h) issue a warning to the data fiduciary or data processor where the business or activity is likely to violate the provisions of this Act; issue a reprimand to the data fiduciary or data processor where the business or activity has violated the provisions of this Act; require the data fiduciary or data processor to cease and desist from committing or causing any violation of the provisions of this Act; require the data fiduciaryor data processor to modify its business or activity to bring it in compliance with the provisions of this Act; temporarily suspend or discontinue business or activity of the data fiduciary or data processor which is in contravention of the provisions of this Act; vary, suspend or cancel any registration granted by the Authority in case of a significantdata fiduciary; suspend or discontinue any cross-border flow of personal data; or require the data fiduciary or data processor to take any such action in respect of any matter arising out of the report as the Authority may think fit. 38