23. Right to prevent processing likely to cause damage or distress (1) Subject to subsection (2), a data subject may, at any time by notice in writing to a data controller, referred to as the “data subject notice”, require the data controller at the end of such period as is reasonable in the circumstances, to— (a) cease the processing of or processing for a specified purpose or in a specified manner; or (b) not begin the processing of or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject if, based on reasons to be stated by him— (i) the processing of that personal data or the processing of personal data for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another person; and (ii) the damage or distress is or would be unwarranted. (2) Subsection (1) shall not apply where— (a) the data subject has given his consent; (b) the processing of personal data is necessary— (i) for the performance of a contract to which the data subject is a party; (ii) for the taking of steps at the request of the data subject with a view to entering a contract; (iii) for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by contract; or (iv) in order to protect the vital interests of the data subject; or (c) in such other cases as may be prescribed by the Federal Government upon recommendations of the Commission through publication in the Official Gazette. (3) The data controller shall, within twenty-one days from the date of receipt of the data subject notice under subsection (1), give the data subject a written notice— (a) stating that he has complied or intends to comply with the data subject notice; or (b) stating his reasons for regarding the data subject notice as unjustified, or to any extent unjustified, and the extent, if any, to which he has complied or intends to comply with it. (4) Where the data subject is dissatisfied with the failure of the data controller to comply with the data subject notice, whether in whole or in part, under subsection (3) (b), the data subject may submit an application to the Commission to require the data controller to comply with the data subject notice. (5) Where the Commission is satisfied that the application of the data subject under subsection (4) is justified or justified to any extent, the Commission may require the data controller to take such steps for complying with the data subject notice. 24. ​Rights of foreign data subjects.​— Foreign data subject shall have all his rights, if any provided under the laws of the country or territory where the foreign data has been collected or data subject resides in so far as consistent with this Act, only against the data controller. 25. Right to erasure.- ​(1) The data subject shall have the right to obtain from the data controller the erasure of personal data concerning him without undue delay and the data 14