(a) cease the processing of or processing for a specified purpose or manner; or (b) not begin the processing of or processing for a specified purpose or in a specified manner, any personal data in respect of which he is the data subject if, based on reasons to be stated by him— (i) the processing of that personal data or the processing of personal data for that purpose or in that manner is causing or is likely to cause substantial damage or distress to him or a relevant person; and (ii) the damage or distress is or would be unwarranted. (2) Sub-section (1) shall not apply where— (a) the data subject has given his consent; (b) the processing of personal data is necessary— (i) for the performance of a contract to which the data subject is a party; (ii) for taking steps at the request of the data subject to enter a contract; (iii) for compliance with any legal obligation to which the data controller is the subject, other than an obligation imposed by contract; or (iv) to protect the vital interests of the data subject; or (c) in such other cases as may be prescribed by the Federal Government upon recommendations of the Commission by publishing in the Official Gazette. (3) The data controller shall, within twenty-one days from the date of receipt of the data subject notice under sub-section (1), give the data subject a written notice including digitally — (a) stating that he has complied or intends to comply with the data subject notice; or (b) stating his reasons for regarding the data subject notice as unjustified, or to any extent unjustified, and the extent, if any, to which he has complied or intends to comply with it. (4) Where the data subject is dissatisfied with the failure of the data controller to comply with the data subject notice, whether in whole or in part, under clause (b) of sub-section (3), the data subject may submit a complaint to the Commission to require the data controller to comply with the data subject notice. (5) Where the Commission is satisfied that the complaint of the data subject under subsection (4) is justified or justified to any extent, the Commission may require the data controller to take such steps for complying with the data subject notice 26