becoming aware of the personal data breach, notify the Commission in respect of the personal data breach except where the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. (2) In the event of delay in notifying personal data breach beyond 72 hours, the personal data breach notification to the Commission shall be accompanied by reasons for the delay. (3) The personal data breach notification shall at least provide the following information:a. description of the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned; b. name and contact details of the data protection officer or other contact point where more information can be obtained; c. likely consequences of the personal data breach; d. measures adopted or proposed to be adopted by the data controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. (4) The data controller may provide the above above listed information as per sub-section (3) in phases without undue delay, where it is not possible to provide the information at the same time. (5) The data controller shall maintain record of any personal data breaches, comprising the facts relating to the personal data breach, its effects and the remedial action taken. (6) The data processor shall also follow the personal data breach notification requirements under this section in event of becoming aware of a personal data breach. CHAPTER III RIGHTS OF DATA SUBJECTS 14. Right of access to personal data.- (1) An individual is entitled to be informed by a data controller whether personal data of which that individual is the data subject is being processed by or on behalf of the data controller. (2) A requestor may, upon payment of a prescribed fee, make a data access request in writing to the data controller— (a) for information of the data subject’s personal data that is being processed by or on behalf of the data controller; and (b) to have communicated to him a copy of the personal data in an intelligible form. (3) A data access request for any information under sub-section (2) shall be treated as a single request, and a data access request for information under clause (a) )of sub-section (2) shall, in the absence of any indication to the contrary, be treated as extending also to such request under clause (b) of subsection (2). (4) Where a data controller does not hold the personal data, but controls the processing of the personal data in such a way as to prohibit the data controller who holds the personal data from complying, whether in whole or part, with the data access request under subsection (2) which relates to the personal data, the first mentioned data controller shall be deemed to hold the personal data and the provisions of this Act shall be construed accordingly. 9