If section 17(1) is contravened, the data controller is guilty of an offence.

Any person who fails to comply with the duty imposed by notification regulations made by virtue of section 20(1) is guilty of an offence.

It shall be a defence for a person charged with an offence under subsection (2) to show that he exercised all due diligence to comply with the duty.