(2) Thedata fiduciary may chargea reasonable fee to be paid for complying with requests made under this Chapter, except for requestsmade under clauses (a) and (b) of sub-section (1) ofsection 24 and section 25 which shall be complied with by the data fiduciary without charging any fee. (3) The Authority may specify a reasonable time period within which the data fiduciaryshall comply with the requests under this Chapter, and such time period shall be communicated to the data principal along with the acknowledgement referred to in sub-section (1). (4) Where any request made under this Chapter is refused by the data fiduciary, it shall provide the data principal making such request with adequate reasons for suchrefusal as per the provisions of this Chapter in writing,and shall inform the data principal regarding the right to file a complaint with the Authority against the refusal within such period and in such manner as may be specified. (5) The data fiduciary is not obliged to comply with any request made under this Chapter where such compliance would harm the rights of any other data principal under this Act. (6) The manner of exercise of rights under this Chapter shall be in such form as may be provided by law or in the absence of such law, in a reasonable format to be followed by each data fiduciary. CHAPTER VII TRANSPARENCY AND ACCOUNTABILITY MEASURES 29. Privacy by Design. — Every data fiduciary shall implement policies and measures to ensure that— (a) (b) (c) (d) (e) (f) (g) managerial, organisational, business practices and technical systems are designed in a manner to anticipate, identify and avoid harm to the data principal; theobligations mentioned in Chapter II are embedded in organisational and business practices; technology used in the processing of personal data is in accordance with commercially accepted or certified standards; legitimate interests of businesses including any innovation is achieved without compromising privacy interests; privacy is protected throughout processing from the point of collection to deletion of personal data; processing of personal data is carried out in a transparent manner; and the interest of the data principal is accounted for at every stage of processing of personal data. 17