(1) A data subject is entitled to obtain from the controller -
(a) confirmation as to whether or not personal data concerning him or her is being processed, and
(b) where that is the case, access to the personal data and the information set out in subsection (2).
(2) That information is -
(a) the purposes of and legal basis for the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data has been disclosed (including recipients or categories of recipients in third countries or international organisations);
(d) the period for which it is envisaged that the personal data will be stored or, where that is not possible, the criteria used to determine that period;
(e) the existence of the data subject's rights to request from the controller -
(i) rectification of personal data (see section 46), and
(ii) erasure of personal data or the restriction of its processing (see section 47);
(f) the existence of the data subjec
…