Data Protection No. 24 of 2019 [Subsidiary] (c) the data subject no longer needs their personal data but the data controller or data processor requires the personal data to be kept in order to establish, exercise or defend a legal claim; or (d) a data subject has objected to the processing of their personal data under regulation 8 and a data controller or data processor is considering legitimate grounds that override those of the data subject. (2) A request for restriction to processing of personal data on any of the grounds provided under section 34 of the Act may be made in Form DPG 1 set out in the First Schedule. (3) A data controller or data processor shall within fourteen days of the request for restriction pursuant to sub-regulation (2), and without charging any fee— (a) admit and implement the request; (b) indicate on the data controller or data processors system that the processing of the personal data has been restricted; and (c) notify any relevant third party of the restriction where personal data, subject to such restriction, may have been shared. (4) A data controller or a data processor may implement a restriction to processing request by— (a) temporarily moving the personal data to another processing system; (b) making the personal data unavailable to third parties; or (c) temporarily removing published data specific to the data subject from its website or other public medium in its control. (5) A data controller or data processor may decline to comply with a request for restriction in processing, where such request is manifestly unfounded or excessive. (6) Where a data controller or data processor declines a request on any of the grounds provided under section 34(2) of the Act, the data controller or data processor shall within fourteen days of the refusal, notify the data subject of the refusal, in writing, and shall provide the reasons for the decision. (7) A data controller or data processor shall not process personal data that has been restricted, except to store the personal data, in accordance with section 34(2)(a) of the Act. 8. Objection to processing (1) Pursuant to section 36 of the Act, a data subject may request a data controller or data processor not to process all or part of their personal data, for a specified purpose or in a specified manner. (2) A request to object the processing may be made in Form DPG 1 set out in the First schedule. (3) A data controller or data processor shall, without charging any fee, comply with a request for objection under sub-regulation (2) within fourteen days of the request. (4) The right to object to processing applies as an absolute right where the processing is for direct marketing purposes which includes profiling to the extent that it is related to such direct marketing. (5) Where the data subject objects to processing for direct marketing purposes, the personal data shall not be processed for such purposes. (6) Where the right to object to processing is not absolute and the request by a data subject has been declined, the data controller or data processor shall inform the data subject of— (a) the reasons for declining the request for objection; and (b) the right to lodge a complaint to the Data Commissioner where dissatisfied. (7) Where a data controller or data processor demonstrates compelling legitimate interest for the processing which overrides the data subject’s interests, or for the 21