18.

A data controller or a data processor who—
(a) processes personal data without registering in accordance
with these Regulations;

(b) provides false or misleading information for the purpose of
registration; or

(c) fails to renew a certificate of registration and continues to
process personal data after the expiry of the certificate,
commits an offence and shall, upon conviction, be liable to
penalty specified under section 73 of the Act.