S17 (b) destroys or deletes a record of personal information about the data subject that the data controller is no longer authorised to retain. (2) A data controller shall, on receipt of a request in terms of subsection (1), take reasonable steps to investigate the challenging of personal information lodged and – (a) correct, destroy or delete the information; or (b) provide that data subject, with credible evidence in support of the correctness of the information. (3) Where credible evidence has been provided under subsection (2)(b), the data subject may apply to the Commission to investigate the disputed information. (4) Where the data controller has taken steps under subsection (2)(a) that result in a change to the information and the changed information has an impact on decisions that have been or will be taken in respect of the data subject in question, the data controller shall, within seven (7) working days inform each person, body or data controller to whom the personal information has been disclosed of those steps. (5) The data controller shall notify a data subject who has made a request in terms of subsection (1), of the outcome of the request within a period of fourteen (14) days of the making of the request. Data controller to give effect to principles of this Act 21. The data controller shall – (a) ensure that the principles set out under this Act and all the measures that give effect to the principles are complied with; and (b) have the necessary internal mechanisms in place for demonstrating compliance with the principles of this Act to both data subjects and the Commission in the exercise of its powers. Prohibition against processing of sensitive personal information 22. Unless specifically permitted under this Act, a data controller shall not process sensitive personal information. PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION Exemption on spiritual, religious or philosophical beliefs of data subject 23. (1) The exemption on processing personal information of the spiritual, religious or philosophical beliefs of a data subject shall not apply if the processing is carried out by – (a) spiritual or religious organizations; or (b) independent sections of those organizations.