Act shall be punished with fine upto three million rupees and in case of a subsequent unlawful processing of personal data, the fine may exceed to …… (2) In case the offence committed under sub-section (1) relates to sensitive data the offender may be punished with fine upto five million rupees. 36. ​Failure to adopt appropriate data security measures​.— Anyone who fails to adopt the security measures that are necessary to ensure data security, when he is required to do so, in violation of the provisions laid down in this Act and the rules made thereunder shall be punished with fine upto one million rupees. 37. ​Failure to comply with orders​.— Anyone who fails to comply with the orders of the commission or the court when he is required to do so, shall be punished with fine upto five hundred thousand rupees. 38​. ​Corporate liability.— ��A person shall be held liable for a non-compliance committed on his instructions or for his benefit or lack of required supervision by any individual, acting either individually or as part of a group of persons, who has a leading position within it, based on a power of representation of the person; an authority to take decisions on behalf of the person; or an authority to exercise control within it. The person shall be punished with fine not exceeding five million rupees. Provided that such punishment shall not absolve the liability of the individual, who has committed the offence. 39. ​Complaint​.— (1) Any aggrieved person may file a complaint before the Commission against any violation of personal data protection rights as granted under this Act, conduct of any data controller, data processor or their processes which a complainant regards as involving:(a) a breach of data subject’s consent to process data; (b) a breach of obligations of the data controller or the data processor in performance of their functions under this Act; (c) provision of incomplete, misleading or false information while taking consent of the data subject; or (d) any other matter relating to protection of personal data. (2) The complainant may file a complaint on a plain paper or on a simplified sample format prescribed by the Commission and the complainant shall certify that he had not already or concurrently filed any application, complaint or suit before any other forum or court. (3) The Commission shall charge reasonable fee for filing or processing of the complaint, as prescribed under this Act and shall also facilitate on-line receipt of complaints. (4) The Commission shall acknowledge the receipt of complaint within three working days and shall dispose of the complaint under intimation to the complainant within thirty days of 21