(2) The data controller shall establish appropriate safeguards against the use of the data for any other purpose. PART V – ENFORCEMENT Complaints 39 (1) A person may submit a complaint to the Commission in the prescribed manner and form – (a) alleging a contravention of this Act; or (b) if the data subject is aggrieved by the determination of a sector in terms of an approved code. Investigation by the Commission 40 (1) The Commission, after receipt of a complaint made in terms of section 39, shall – (a) investigate any alleged contravention in the prescribed manner; (b) decide in accordance with section 41 to take no action on the complaint; (c) act, where appropriate, as conciliator in relation to any such contravention in the prescribed manner, where it appears that it might be possible to secure a settlement between the parties; and (d) take such further action as is contemplated under this Part. (2) The Commission, may, on its own initiative, commence an investigation under subsection (1).