controller and/or data processor and do not process the data may apply for exemptions as permitted under this Act, and Rules made thereunder. (4) The Commission may propose time-bound exemption to the Federal Government if requested by a data controller or data processor only in case of specific situations/use cases. CHAPTER VIII THE COMMISSION 35. Establishment of the Commission. – (1) The Federal Government shall, by a Gazetted notification, establish a Commission for this Act, which shall be called the National Commission for Personal Data Protection (NCPDP) of Pakistan, within six months of the commencement of this Act. Provided that the Federal Government may increase the number of members of the Commission and prescribe their qualifications and mode of appointment, as it considers necessary for effectively dispensing the functions enumerated in this Act. (2) The Commission shall be an autonomous body under the administrative control of the Federal Government with its headquarters located in Islamabad. (3) The Commission may set up its establishments including sub-offices at Provincial capitals and such other places, as it may deem necessary from time to time. (4) The Commission shall be a statutory corporate body, having perpetual succession and a common seal, subject to the provisions of this Act, and shall have the following powers. (a) The Commission – (i) may sue or be sued or enter into contracts for the purpose of this Act; (ii) has the power to acquire, purchase, hold, and dispose of both moveable and immovable property of every description; (iii) may convey, assign, surrender, charge, mortgage, reassign, transfer or otherwise dispose of or deal with any moveable or immovable property or any interest vested in it; 32