Personal Data Protection Act, No. 9 of 2022 11 (d) an heir to exercise a deceased data subject’s rights within a period of ten years from the date of demise of such data subject, in the manner prescribed by regulations. (6) A request made by a data subject under sections 13, 14, 15 or 16 may be accompanied by such fees, as may be prescribed by regulations made under this Act. (7) Where a fee is charged under subsection (6), the controller shall inform the data subject the details of such fees and reasons for imposing same. 18. (1) Subject to section 19, every data subject shall have the right to request a controller to review a decision of such controller based solely on automated processing, which has created or which is likely to create an irreversible and continuous impact on the rights and freedoms of the data subject under any written law. (2) The provisions of subsection (1) shall not apply where a decision of a controller, based on automated processing is– (a) authorized by any written law, which a controller is subject to; (b) authorized in a manner determined by the Authority; (c) based on the consent of the data subject; or (d) necessary for entering into or performance of a contract between the data subject and the controller, and the controller shall comply with such measures and applicable criteria as may be specified by the Authority by rules made in that behalf to safeguard the rights and freedoms of the data subject: Automated individual decision making