24 Laws of Malaysia ACT 709 Revocation of registration 18. (1) The Commissioner may revoke the registration of a data user if the Commissioner is satisfied that— (a) the data user has failed to comply with any of the provisions of this Act; (b) the data user has failed to comply with any conditions or restrictions imposed upon the issuance of the certificate of registration; (c) the issuance of the certificate of registration was induced by a false representation of fact by the data user; or (d) the data user has ceased to carry on the processing of personal data. (2) Notwithstanding subsection (1), the Commissioner shall not revoke the registration of a data user unless the Commissioner is satisfied that, after giving the data user an opportunity of making any representation in writing he may wish to make, the registration should be revoked. (3) Where the registration of the data user is revoked, the Commissioner shall issue a notice of revocation of registration to the data user, and the certificate of registration issued in respect of such registration shall have no effect upon service of the notice of revocation of registration. (4) A data user whose registration has been revoked under this section and who continues to process personal data thereafter commits an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both. Surrender of certificate of registration 19. (1) Where the certificate of registration is revoked in pursuance of section 18, the holder of the certificate shall, within seven days from the date of service of the notice of revocation of registration, surrender the certificate to the Commissioner. (2) A person who fails to comply with subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.