RIGHTS OF DATA SUBJECTS 16. Right, to access. – (1) A data subject shall be given access to his personal data held by a data controller except where compliance with a request to access is declined under the provisions of this Act. (2) A data subject shall have the right to obtain confirmation from a data controller whether the personal data of a data subject is under processing or has been processed, by or on behalf of the data controller. (3) A requestor may upon payment of a prescribed fee based on an administrative cost, make a data access request in writing to the data controller: for information regarding the data subject’s personal data that is being processed by or on behalf of the data controller; and to provide him with a copy of the personal data in an intelligible form. (4) Where a data controller has shared the data with another data controller/processor, therefore, the first data controller possessing any consent of the data subject shall be liable as provided under sub-section (3). 17. Compliance with the data access request. – (1) Subject to sub-section (2) of section 31 a data controller shall comply with a data access request under section 16 not later than thirty days from the date of receipt of the data access request. (2) A data controller who is unable to comply with a data access request within the period as specified in sub-section (1) must before the expiration of that period— (a) By a written notice inform the requestor and the Commission that the data controller is unable to comply with the data access request within such period and shall furnish the reasons for his non-compliance; and (b) comply with the data access request to the extent possible. (3) Notwithstanding sub-section (2), the data controller shall entirely comply with the data access request, not later than fourteen days after the expiration of the period as stipulated in sub-section (1). 20