(1) An individual is entitled to obtain from a controller -
(a) confirmation as to whether or not personal data concerning the individual is being processed, and
(b) where that is the case -
(i) communication, in intelligible form, of the personal data of which that individual is the data subject, and
(ii) the information set out in subsection (2).
(2) That information is -
(a) the purposes of and legal basis for the processing;
(b) the categories of personal data concerned;
(c) the recipients or categories of recipients to whom the personal data has been disclosed;
(d) the period for which the personal data is to be preserved;
(e) the existence of a data subject’s rights to rectification and erasure of personal data (see section 100);
(f) the right to lodge a complaint with the Commissioner and the contact details of the Commissioner;
(g) any information about the origin of the personal data concerned.
(3) A controller is not obliged to provide information under this section unless
…