277 (3) A data subject shall have a right to challenge the written reasons for denial of requests made in terms of subsection (1). (4) If, in accordance with subsection (1) (b), personal information is communicated to a data subject, the data subject shall be advised of the right in terms of section 27 to challenge the correctness of the information. Correction of personal information . (1) A data subject sha1l free of charge have a right to chailenge the correctness of information by lequesting that a data controller 21 (a) (b) (2) corect or delete personal information about the data subject in its possession or under its control that is inaccurate, in'elevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or destroy or delete a recold of personal information about the data subject that the data controller is no longer authorised to retain. A data controller shall, on receipt of a request in terms of sub- section (1), take reasonable steps to investigate the challenge lodged and - (a) (b) colTect, destroy or delete the information; or provide the data subject, with cledible evidence in support of the conectness of the informatiou. (3) Where credible evidence has been plovided under subsection (2) (b), the data subject may apply to the commission to investigate the disputed in- formation. (4) Where the data controller has taken steps under subsection (Z) (a) that lesult in a change to the information and the changed information has an irnpact on decisions that have been ol will be taken in respect of the data subject in question, the data contloller sha11, within 7 working days, inform each person or body or data controllel party to whom the personal information has been disclosed ofthose steps.