36 Personal Data Protection Act, No. 9 of 2022 PART VII PENALTIES Imposition of penalties 38. (1) Where a controller or processor fails to comply with a directive issued under the provisions of section 35, the Authority shall after taking into consideration the impact on data subjects, the nature and extent of relevant noncompliances and the matters referred to in section 39 of this Act, by notice require such controller or processor to pay a penalty, which shall not exceed a sum of rupees ten million for each non-compliance. (2) Where a controller or processor has been subjected to a penalty on a previous occasion, subsequently fails to conform to a directive on any further occasion such person shall in addition to the penalty which may be imposed on him under subsection (1) be liable to the payment of an additional penalty consisting of twice the amount imposed as a penalty on the second and for each subsequent noncompliance. (3) The Authority shall be responsible for the collection of a penalty imposed under this section and the money so collected shall be credited to the Consolidated Fund after deducting such sum of money collected as compensation if any payable to the aggrieved person affected by reason of the non-compliance of the provisions of paragraph (c) of subsection (2) of section 35. (4) If a controller or processor becomes liable to a penalty in terms of subsection (1) or (2) fails to pay such penalty, within such period as may be specified in such notice, the Authority may make an exparte application to the Magistrate Court of Colombo for an order requiring the payment of the penalty recovered in a like manner as a fine imposed by such court notwithstanding such sum may exceed the amount of fine which that court may, in the exercise of its ordinary jurisdiction impose.