Data Protection No. 24 of 2019 [Subsidiary] (2) A request for data portability may be made in Form DPG 4set out in the First Schedule. (3) A data controller or data processor shall within thirty days of the request and upon payment of the prescribed fees port personal data to the data subject’s choice of recipient. (4) Where fee is charged under sub-regulation (2), the fee shall be reasonable and not exceed the cost incurred to actualize the request. (5) A data controller or data processor who receives personal data that has been ported shall, with respect to such data, comply with the requirement of the Act and these Regulations. (6) Where a data controller or data processor declines the portability request, a data controller or data processor shall, within seven days, notify the data subject of the decline and the reasons for such decline in writing. (7) The exercise of the right to data portability by a data subject shall not negate the rights of a data subject provided under the Act. 12. Right of erasure (1) Pursuant to section 40 (1) (b) of the Act, a data subject may, request a data controller or data processor to erase or destroy personal data held by the data controller or data processor where — (a) the personal data is no longer necessary for the purpose which it was collected; (b) the data subject withdraws their consent that was the lawful basis for retaining the personal data; (c) the data subject objects to the processing of their data and there is no overriding legitimate interest to continue the processing; (d) the processing of personal data is for direct marketing purposes and the individual objects to that processing; (e) the processing of personal data is unlawful including in breach of the lawfulness requirement; or (f) the erasure is necessary to comply with a legal obligation. (2) A data subject may request for erasure of their personal data held by a data controller or data processor in Form DPG5 set out in the First Schedule. (3) A data controller or data processor shall respond to a request for erasure under subregulation (2) within fourteen days of the request. (4) A right of erasure does not apply if processing is necessary for one of the following reasons— (a) to exercise the right of freedom of expression and information; (b) to comply with a legal obligation; (c) for the performance of a task carried out in the public interest or in the exercise of official authority; (d) for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or (e) for the establishment, exercise or defence of a legal claim. (5) A request for erasure shall be free of charge. 13. Exercise of rights by others (1) Subject to section 27 of the Act, where a person duly authorised by a data subject seeks to exercise the rights on their behalf, the data controller or data processor shall act in the best interests of the data subject. 23