Section 36

The Authority may, if it is satisfied that an organisation has not complied or is not complying with any provision of Part 3, 4, 5, 6 or 7, give the organisation any direction that the Authority thinks fit in the circumstances to ensure compliance with that provision.

Without limiting subsection (1), the Authority may, if it thinks fit in the circumstances to ensure compliance with any provision of Part 3, 4, 5, 6 or 7, give an organisation all or any of the following directions -

{a} to stop collecting, using or disclosing personal data m contravention of this Order;

{b) to destroy personal data collected in contravention of this Order;

{c) to comply with any direction of the Authority under section 35(2).