offence under this Act, he may investigate the matter or cause it to be investigated by an authorised officer. (3) An enforcement notice served under subsection (1) shall – (a) specify the provision of this Act which has been, is being or is likely to be, contravened; (b) specify the measures that shall be taken to remedy or eliminate the situation which makes it likely that a contravention will arise; (c) specify a period which shall not be less than 21 days within which those measures shall be implemented; and (d) state that a right of appeal is available under section 51. (4) On complying with an enforcement notice, the controller or processor, as the case may be, shall, not later than 21 days after compliance, notify – (a) the data subject concerned; and (b) where such compliance materially modifies the data concerned, any person to whom the data was disclosed during the period beginning 12 months before the date of the service of the notice and compliance, of any amendment. ending immediately before