9. (2) Thedata fiduciary shall provide the information as required under this section to the data principal in a clear and concise manner that is easily comprehensible to a reasonable person and in multiple languages where necessary and practicable. (3) Sub-section (1) shall not apply where the provision of notice under this section would substantially prejudice the purpose of processing of personal data under sections15or 21of this Act. Data quality.— (1) Thedata fiduciary shall take reasonable steps to ensure that personal data processed is complete, accurate, not misleading and updated, having regard to the purposes for which it is processed. (2) In considering whether any reasonable step is necessaryunder sub-section (1), the data fiduciary shall have regard to whether the personal data— (a) (b) (c) (3) 10. is likely to be used to make a decision about the data principal; is likely to be disclosed to other individuals or entities including other data fiduciaries or processors; or is kept in a form that distinguishes personal data based on facts from personal data based on opinions or personal assessments. Where personal data is disclosed to other individuals or entities, including other data fiduciaries or processors, and the data fiduciary subsequently finds that such data does not comply with sub-section (1), the data fiduciary shall take reasonable steps to notify suchindividuals or entities of thisfact. Data storage limitation.— (1) Thedata fiduciary shall retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is processed. (2) Notwithstanding sub-section (1), personal data may be retained for a longer period of time if such retention is explicitly mandated, or necessary to comply with any obligation, under a law. (3) The data fiduciary must undertake periodic review in order to determine whether it is necessary to retain the personal data in its possession. (4) Where it is not necessary for personal data to be retained by the data fiduciary under subsections (1) and (2), then such personal data must be deleted in a manner as may be specified. 8