(1) An authorised person is subject to the Regulator’s direction in the exercise of powers under this Act.
(2) A direction under subsection (1) may be of a general nature or may relate to a stated matter or stated class of matter.
(3) Without limiting subsection (1) , the Regulator must issue directions to authorised persons to ensure powers are exercised under this Act in a way that minimises any adverse effect on the privacy, confidentiality and security of persons and businesses.