Article 22 - Directions

(1) If the QFC Authority is satisfied that a Data Controller has contravened or is contravening these Regulations or Rules made for the purpose of these Regulations, the QFC Authority may issue a direction to the Data Controller requiring him to do either or both of the following:
(A) to do or refrain from doing any act or thing within such time as may be specified in the direction; or
(B) to refrain from Processing any Personal Data specified in the direction or to refrain from ProcessingPersonal Data for a purpose or in a manner specified in the direction.
(2) A direction issued under Article 22(1) shall contain:
(A) a statement of the contravention of these Regulations or Rules which the QFC Authority is satisfied is being or has been committed; and
(B) a statement to the effect that the Data Controller may appeal a decision of the QFC Authority to issue the direction to the Tribunal.
(3) An appeal against a decision by the QFC Authority to issue a direction pursuant to Article 22(1) may be made to the Tribunal.