15. Compliance with data access request.- ​(1) Subject to sub-section (2) and section 14, a data controller shall comply with a data access request under section 12 not later than [thirt] days from the date of receipt of the data access request. (2) A data controller who is unable to comply with a data access request within the period specified in subsection (1) shall before the expiration of that period— (a) by notice in writing inform the requestor that the data controller is unable to comply with the data access request within such period and the reasons why the data controller is unable to do so; and (b) comply with the data access request to the extent that the data controller is able to do so. (3) Notwithstanding subsection (2), the data controller shall comply in whole with the data access request not later than fourteen days after the expiration of the period stipulated in subsection (1). 16. Circumstances where data controller may refuse to comply with data access request.- ​(1) A data controller may refuse to comply with a data access request under section 12 if— (a) the data controller is not supplied with such information as the data controller may reasonably require— (i) in order to satisfy itself as to the identity of the requestor; or (ii) where the requestor claims to be a relevant person, in order to satisfy itself— (A) as to the identity of the data subject in relation to whom the requestor claims to be the relevant person; and (B) that the requestor is the relevant person in relation to the data subject; (iii) to locate the personal data to which the data access request relates; (b) the data controller cannot comply with the data access request without disclosing personal data relating to another individual who can be identified from that information, unless— (i) that other individual has consented to the disclosure of the information to the requestor; or (ii) it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual; (c) subject to subsection (3), any other data controller controls the processing of the personal data to which the data access request relates in such a way as to prohibit the first-mentioned data controller from complying, whether in whole or in part, with the data access request; (d) providing access may constitute a violation of an order of a court; (e) providing access may disclose confidential information relating to business of the data controller; or (f) such access to personal data is regulated by another law. (2) In determining for the purposes of clause (ii) of clause (b) of sub-section (1) whether it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual, regard shall be given, in particular, to— (a) any duty of confidentiality owed to the other individual; (b) any steps taken by the data controller with a view to seeking the consent of the other individual; (c) whether the other individual is capable of giving consent; and (d) any express refusal of consent by the other individual. 10