Section 43
Powers of investigation
of Personal Data Protection Order, 2025
(1)
The Authority may, on complaint or of its own motion, conduct an investigation under this section to determine whether or not an organisation is complying with this Order, including a voluntary undertaking given under section 39.
(2)
The Authority may suspend, discontinue or refuse to conduct an investigation under this section if it thinks fit, including but not limited to any of the following circumstances -
(a} the complainant has not complied with a direction under section 34(2);
(b)
the parties involved in the matter have mutually agreed to settle the matter;
(c)
any party involved in the matter has commenced legal proceedings against another party in respect of any contravention or alleged contravention of this Order by the other party;
(d)
the Authority accepts a voluntary undertaking given by an organisation under section 39( 1) in relation to the matter;
{e) the Authority is of the opinion that the matter may be more appropriately investigated by another regulatory authority and has referred the matter to that authority; or
(f)
the Authority is of the opinion that -
(i)
a complaint is frivolous or vexatious or is not made in good faith; or
(ii)
any other circumstances warrant refusing to conduct, suspending or discontinuing the investigation.
(3)
For the avoidance of doubt, notwithstanding subsection (Z)(d}, the
Authority may conduct or resume an investigation under this section at any time if an organisation fails to comply with a voluntary undertaking given under section 39(1) in relation to any matter.
(4)
An organisation shall retain records relating to an investigation under this section for one year after the conclusion of the investigation or any longer period specified in writing by the Authority.