Notwithstanding any criminal sanctions under this Act, if the Commission, after completing an investigation under Section 046 of this Act, is satisfied that a data controller or data processor has violated any provision of this Act or subsidiary legislation made under this Act, it —

(a) may make any appropriate enforcement order or impose a sanction on the data controller or data processor; and

(b) shall inform the data controller or data processor, and if applicable, any data subject who lodged a complaint leading to the investigation, in writing of its decision.