"If it is found that any individual or entity has violated the Personal Data Protection Act or caused harm, the PDPC will investigate, gather evidence, and report the findings to the expert committee for further administrative consideration."