(1) Subject to subsections (7), (9) and (12) and sections 93(4)(ii) and 94, an individual who believes that personal data relating to him or her have been or are being processed by or on behalf of a controller, if he or she so requests the controller by notice in writing shall -
(a) be informed by the controller whether personal data relating to him or her have been or are being processed by or on behalf of the controller, and
(b) where such data have been or are being so processed, be provided by the controller with the following information:
(i) a description of -
(I) the purpose of, and the legal basis for, the processing,
(II) the categories of personal data concerned,
(III) the recipients or categories of recipients to whom the personal data concerned have been disclosed, and
(IV) the period for which the personal data concerned will be retained, or where it is not possible to determine the said period at the time of the giving of the information, the criteria used to determine th
…