21.

The Data Commissioner shall enforce or take action to
recover a penalty—
(a) upon the lapse of the period specified in the penalty notice
for payment of the penalty;
(b) on the final determination of any appeal against the penalty
notice; or
(c) on the lapse of the period given to appeal against the penalty