A data subject, who is aggrieved by the decision, action, or inaction of a data controller or data processor in violation of this Act, or subsidiary legislation made under this Act may lodge a complaint with the Commission.

The Commission may investigate any complaint referred to it, where it appears to the Commission that the complaint is not frivolous or vexatious.

The Commission may initiate an investigation of its own accord where it has reason to believe a data controller or data processor has violated or is likely to violate this Act or any subsidiary legislation made under this Act.

The Commission may, for the purpose of an investigation, order a person to — (a) attend at a specific time and place for the purpose of being examined orally in relation to a complaint; (b) produce such document, record, or article, as may be r...

Where any material to which an investigation relates, consists of information stored in any document, record, minutes, mechanical or electronic device, the Commission may require the person named to produce such material or give access to the Commission...

For the purposes of subsection (5), the person shall ensure that the information relating to the material under investigation is visible and legible, in a structured, commonly used and machine-readable format

The Commission may, where necessary, make representations to — (a) the data controller or data processor on behalf of a complainant; or (b) a complainant on behalf of the data controller or data processor.

The Commission shall — (a) establish a unit to receive and follow up on complaints from data subjects and conduct investigations; and (b) adopt rules and procedures on handling complaints and conducting investigations referred to it under this A...