(4) The Federal Government may assign any other functions to the Commission from time to time, as it may consider necessary for effectively discharging functions under this Act. 40. Powers of the Commission. – (1) The Commission shall exercise powers that enable it to effectively perform its functions as specified in section 39 and under the provisions of this Act. (2) Without prejudice to the generality of the foregoing power, the Commission shall(a) decide the complaint or pass any order and for this purpose, the Commission is deemed to be a Civil Court and shall have the same powers as are vested in such court under the Code of Civil Procedure Code, 1908 [Act No. V of 1908]. (b) formulate, approve, and implement policies, procedures, and regulations for its internal administration, operations, human resource management, procurements, financial management, and partnerships; (c) formulate a compliance framework for monitoring and enforcement to ensure transparency and accountability, subject to the measures including but not limited to the following: (i) Privacy (ii) Transparency (iii) Security safeguards (iv) Personal data breach (v) Data protection impact assessment (vi) Record maintenance (vii) Data audits (viii) Responsibilities of data protection officer (ix) Processing by entities other than the data controller (x) Classification of the data controller (xi) Grievance redressal mechanism (xii) Special permissions regarding biometric data (xiii) Cross-border data sharing (xiv) Adequacy framework for cross-border data flows (xv) Data portability and automated processing including profiling (d) Identify other categories including big/large /significant data controllers /processors, and define special measures for compliance by the provisions of the Act or Rules 36