(c) of any information available to the data controller as to the source of that personal data; (d) of the data subject’s right to request access to and to request correction of the personal data and how to contact the data controller with any inquiries or complaints in respect of the personal data; (e) of the class of third parties to whom the data controller discloses or may disclose the personal data; (f) of the choices and means the data controller offers the data subject for limiting the processing of personal data, including personal data relating to other persons who may be identified from that personal data; (g) whether it is obligatory or voluntary for the data subject to supply the personal data; and (h) where it is obligatory for the data subject to supply the personal data, the consequences for the data subject if he fails to supply the personal data. (2) The notice under sub-section (1) shall be given as soon as reasonably possible by the data controller— (a) when the data subject is first asked by the data controller to provide his personal data; (b) when the data controller first collects the personal data of the data subject; or (c) in any other case, before the data controller— (i) uses the personal data of the data subject for a purpose other than the purpose for which the personal data was collected; or (ii) discloses the personal data to a third party. (3) A notice under sub-section (1) shall be in the national and English languages, and the individual shall be provided with a clear and readily accessible means to exercise his choice, where necessary, in the national and English languages. 7. Non-disclosure of personal data.- ​Subject to section 20, no personal data shall, without the consent of the data subject, be disclosed— (a) for any purpose other than— (i) the purpose for which the personal data was to be disclosed at the time of collection of the personal data; or (ii) a purpose directly related to the purpose referred to in subparagraph (i); or (b) to any party other than a third party of the class of third parties as specified in clause (e) of sub-section (1) of section 6. 8. Security requirement.- (1) The Commission shall prescribe standards to protect personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction. (2) A data controller shall, when processing personal data, take practical steps to protect the personal data in the terms mentioned under sub-section (1) by having regard— (a) to the nature of the personal data and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction; (b) to the place or location where the personal data is stored; (c) to any security measures incorporated into any equipment in which the personal data is stored; 7