Section 91 Parties to be informed of result of assessment

  1. After completing the assessment referred to in section 89 the Regulator—
    1. must report to the responsible party the results of the assessment and any recommendations that the Regulator considers appropriate; and
    2. may, in appropriate cases, require the responsible party, within a specified time, to inform the Regulator of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken.
  2. The Regulator may make public any information relating to the personal information management practices of a responsible party that has been the subject of an assessment under this section if the Regulator considers it in the public interest to do so.
  3. A report made by the Regulator under subsection (1) is deemed to be the equivalent of an enforcement notice in terms of section 95.