and regulations; (e) Formulate a registration framework for data controllers and data processors under the Act or Commission may impose additional requirements under sub-section 3 of Section 5; (f) Take prompt and appropriate action in response to a data security breach as per the provisions of the Act; (g) Powers of search and seizure while taking cognizance of the complaint; (h) Prescribe a schedule of costs and the mode of payment for filing the complaint, its format, and matters ancillary thereto; (i) Seek information from data controllers concerning data processing under this Act and impose penalties for non-observance of data security practices and for not complying with the provisions of this Act; (j) Prescribe increased penalties/fines after every three years if deems appropriate; (k) Order a data controller to take such reasonable measures as it may deem necessary to redress the grievances of an applicant in case of non-implementation of any provision of this Act; and (l) Summon and enforce the attendance of witnesses and ensure their oral and written evidence under oath; (m) To take any action to carry out the purposes of this Act. 41. Power of the Commission to call for information. – (1) Without prejudice to the other provisions of this Act, the Commission may require a data controller or the data processor to provide such information as may be reasonably required by it for effectively discharging its functions under this Act. (2) Whenever the Commission requires any information from the data controller or data processor under sub-section (1), the concerned officer of the Commission shall provide a written notice to the data controller or the data processor stating the reason for such requisition in a specified manner and form in which such information may be provided. 42. Meetings of the Commission. – (1) The Chairperson shall chair and convene a meeting of the Commission. (2) In case, where the position of the Chairperson is vacant or he is not available, the 37