No. 24 of 2019 Data Protection [Subsidiary] establishment, exercise or defence of a legal claim, the data controller or data processor shall inform the data subject of— (a) the reasons for declining the request for objection; and (b) the right to lodge a complaint to the Data Commissioner where dissatisfied. 9. Data access request (1) A data subject has a right to obtain from the data controlleror data processor confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the information as to— (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, including recipients in other countries or territories; (d) where possible, the envisaged period for which the personal data may be stored, or, if not possible, the criteria used to determine that period; and (e) where the personal data is not collected from the data subject, any available information as to the source of collection. (2) A data subject may request to access their personal data in Form DPG 2 set out in the First Schedule. (3) A data controller or data processor shall— (a) on request, provide access to a data subject of their personal data in its possession; (b) put in place mechanisms to enable a data subject to proactively access or examine their personal data; or (c) provide the data subject with a copy of their personal data. (4) A data controller or a data processor shall comply with a request by a data subject to access their personal data within seven days of the of the request. (5) Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. (6) Compliance with a request for access to personal data shall be free of charge. 10. Rectification of personal data (1) Pursuant to section 40 of the Act, a data subject may request a data controller or data processor to rectify their personal data, which is untrue, inaccurate, outdated, incomplete or misleading. (2) A request for rectification may be made in Form DPG 3 set out in the First Schedule. (3) An application for rectification of personal data may be supported by such documents as may be relevant to the rectification sought. (4) A data controller or data processor shall within fourteen days of the request, rectify an entry of personal data in the database where the data controller or data processor is satisfied that a rectification is necessary. (5) Where a request for rectification is declined, a data controller or data processor shall, in writing, notify a data subject of that refusal within seven days and shall provide reasons for refusal. (6) A request for rectification shall made free of charge. 11. Data portability request. (1) Pursuant to section 38 of the Act, a data subject may apply to port or copy their personal data from one data controller or data processor to another. 22