(1) Where a data subject requests the rectification or erasure of personal data or the restriction of its processing, the controller must inform the data subject in writing -
(a) whether the request has been granted, and
(b) if it has been refused -
(i) of the reasons for the refusal,
(ii) of the data subject's right to make a request to the Commissioner under section 51,
(iii) of the data subject's right to lodge a complaint with the Commissioner, and
(iv) of the data subject's right to apply to a court under section 167.
(2) The controller must comply with the duty under subsection (1) -
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (see section 54).
(3) The controller may restrict, wholly or partly, the provision of information to the data subject under subsection (1)(b)(i) to the extent that and for so long as the restriction is, having regard to the fundamental rights and legitimate interests of the data subject, a necessary and propor
…