(3) Clause (c) of sub-section (1) shall not operate so as to excuse the data controller from complying with the data access request under subsection (2) of section 15 to any extent that the data controller can comply with the data access request without contravening the prohibition concerned. 17. Right to correct personal data.-​ (1) Where— (a) a copy of the personal data has been supplied by the data controller in compliance with the data access request under section 12 and the requestor considers that the personal data is inaccurate, incomplete, misleading or not up-to-date; or (b) the data subject knows that his personal data being held by the data controller is inaccurate, incomplete, misleading or not up-to-date, the requestor or data subject, as the case may be, may make a data correction request in writing to the data controller that the data controller makes the necessary correction to the personal data. (2) Where a data controller does not hold the personal data, but controls the processing of the personal data in such a way as to prohibit the data controller who holds the personal data from complying, whether in whole or in part, with the data correction request under subsection (1) which relates to the personal data, the first-mentioned data controller shall be deemed to be the data controller to whom such a request may be made and the provisions of this Act shall be construed accordingly. 18. Compliance with data correction request.- ​(1) Subject to subsections (2), (3) and (5) and section 19, where a data controller is satisfied that the personal data to which a data correction request relates is inaccurate, incomplete, misleading or not up-to-date, he shall, not later than thirty days from the date of receipt of the data correction request— (a) make the necessary correction to the personal data; (b) supply the requestor with a copy of the personal data as corrected; and (c) subject to subsection (4), where— (i) the personal data has been disclosed to a third party during the twelve months immediately preceding the day on which the correction is made; and (ii) the data controller has no reason to believe that the third party has ceased using the personal data for the purpose, including any directly related purpose, for which the personal data was disclosed to the third party, take all practicable steps to supply the third party with a copy of the personal data so corrected accompanied by a notice in writing stating the reasons for the correction. (2) A data controller who is unable to comply with a data correction request within the period specified in subsection (1) shall before the expiration of that period— (a) by notice in writing inform the requestor that he is unable to comply with the data correction request within such period and the reasons why he is unable to do so; and (b) comply with the data correction request to the extent that he is able to do so. (3) Notwithstanding subsection (2), the data controller shall comply in whole with the data correction request not later than fourteen days after the expiration of the period stipulated in subsection (1). 11