Data Protection [No. 3 of 2021 121 (2) A data subject has the right to have the data subject’s personal data transmitted directly from one data controller to another, where technically or otherwise feasible. 66. A data controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with this Act to each recipient to whom the personal data have been disclosed, where practicable. Notification obligation 67. The rights of a data subject under this Part shall, to the extent necessary, not apply where processing is— D e r o ga t i o n from rights (a) for compliance with a legal obligation which requires processing by any written law to which the data controller is subject; (b) for the performance of a task carried out in the public interest; (c) in the exercise of official authority vested in the data controller; (d) for scientific or historical research purposes; or (e) for the establishment, exercise or defence of legal claims. 68. A data subject may lodge a complaint with the Data Protection Commissioner if the data subject considers that the processing of personal data by a data controller or data processor contravenes this Act. Complaints 69. A person who is aggrieved with the decision of the Data Protection Commissioner may appeal to the High Court within thirty days of the Data Protection Commission’s decision. Appeals PART X TRANSFER OF PERSONAL DATA OUTSIDE THE REPUBLIC 70. (1) A data controller shall process and store personal data on a server or data centre located in the Republic. (2) Despite subsection (1), the Minister may prescribe categories of personal data that may be stored outside the Republic. (3) Despite subsection (2), sensitive personal data shall be processed and stored in a server or data centre located in the Republic. Cross-border transfer of personal data