Personal Data Protection Act, No. 9 of 2022 9 (c) the requirement to erase personal data is required by any written law or on an order of a competent court to which the data subject or controller is subject to. 17. (1) Where a controller receives a written request from a data subject under sections 13, 14, 15 or 16, such controller shall inform the data subject in writing, within twenty-one working days from the date of such request, whether– (a) such request has been granted; (b) such request has been refused under subsection (2) and the reasons thereof unless such disclosure is prohibited by any written law; or (c) the controller has refrained from further processing such personal data under sections 14(2) or 15 and reasons thereof, and inform the availability of the right of appeal to the data subject in respect of the decisions made by the controller under paragraphs (b) or (c). (2) The controller may, refuse to act on a request made under sections 13, 14, 15 or 16 of this Act, by a data subject having regard to– (a) the national security; (b) public order; (c) any inquiry conducted, investigation or procedure carried out under any written law; (d) the prevention, detection, investigation or prosecution of criminal offences; Grant or refusal of rectification, completion, erasure or refrain from further processing