40. ​Temporary provisions​.— All data controllers and data processors shall adopt necessary security measures within [six months] from the day on which this Act comes into force. 41. ​Power to make rules.— (1)​The Commission may with the approval of the Federal Government, by notification in the official Gazette, make rules to carry out the purposes of this Act. (2) Without prejudice to the generality of the foregoing, these rules may empower the Federal Government to:(a) prepare and encourage the drawing up of suitable codes of conduct and ethics by data processors and data controllers; (b) verify the compliance of such codes with applicable laws; (c) seek views of data controller and data processors in any manner related to electronic data; (d) contribute to the publicity and enforcement of such codes; (e) interact and cooperate with international and regional bodies performing similar functions; and (f) set up or accredit bodies to audit the security measures of the data controllers and data processors. (3) All public and regulatory authorities especially in the banking, insurance, telecommunication, legal and health sector shall assist the Commission in exercise and performance of its powers and functions under this Act. 42. Relationship of the Act with other laws.- ​The provisions of this Act shall have effect notwithstanding anything to the contrary contained in any other law on the subject for the time being in force. 43. Removal of difficulties.—​If any difficulty arises in giving effect to the provisions of this Act, the Federal Government may, within two years of the commencement of this Act and by order published in the official Gazette, make such provisions non inconsistent with the provisions of the Act as may appear to be necessary for removing the difficulty. __________________ 23