Personal Data Protection Act, No. 9 of 2022 59 II, the existence of the right of the data subject to withdraw his consent, and the procedure for such withdrawal, without affecting the lawfulness of processing based on consent before its withdrawal; (g) recipients or third parties with whom such personal data may be shared, if applicable; (h) information regarding any cross-border transfer of the personal data that the controller intends to carry out, if applicable; (i) the period for which the personal data shall be retained in terms of section 9 or where such period is not known, the criteria for determining such period; the existence of and procedure for the exercise of rights of the data subject referred to in Part II; (j) (k) the existence of a right to file complaints to the Authority; (l) whether the provision of personal data by the data subject is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data; and (m) the existence of automated individual decision-making referred to in section 18, including profiling, and, at least in those cases, reasonably meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 2. Where the controller intends to further process the personal data for a purpose other than for which it was originally collected, the controller shall provide the data subject detailed information on the further processing in the manner provided in item 1 of this Schedule and the purpose thereof. 3. Items 1 and 2 of this Schedule shall not apply where the data subject already has obtained or made aware of the information.