Further details of these specifications are established out in Parts 2, three and 4. The regulator will be in a position to just take enforcement motion from organizations that fall short to comply with these demands, employing the powers set out in Box 19. In addition the regulator might also have to have info from third parties that are not in scope (see paragraph 4.24).