(1) An authorised officer who has been directed under section 137(2) to carry out an investigation may, for the purposes of the investigation -

(a) require a person, being a controller or processor, or an employee or agent of such controller or processor, who, in the authorised officer's opinion -

(i) possesses information that is relevant to the investigation, or

(ii) has any record or document within the person's possession or control or within the person's procurement that are relevant to the investigation,

to provide that record or document, as the case may be, to the authorised officer, and

(b) where the authorised officer thinks fit, require that person to attend before him or her for the purpose of so providing that information, record or document, as the case may be,

and the person shall comply with the requirement.

(2) A requirement under subsection (1) shall specify -

(a) a period within which, or a date and time on which, the person the subject of the requirement is to comply with the requirement, and

(b) as the authorised officer concerned thinks fit -