9. (1) A data subject has a right to obtain from the data controller or data processor confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the information as to—

(a)  the purposes of the processing;

(b)  the categories of personal data concerned;

(c)  the recipients or categories of recipient to whom the personal data have been or will be disclosed, including recipients in other countries or territories;

(d)  where possible, the envisaged period for which the personal data may be stored, or, if not possible, the criteria used to determine that period; and

(e)  where the personal data is not collected from the data subject, any available information as to the source of collection.

(2) A data subject may request to access their personal data in Form DPG 2set out in the First Schedule.

(3) A data controller or data processor shall—

       (a) on request, provide access to a data subject of their personal data in its possession;

       (b) put in place mechanisms to enable a data subject to proactively access or examine their personal data; or

(c) provide the data subject with a copy of their personal data.

   (4) A data controller or a data processor shall comply with a request by a data subject to access their personal data within seven days of the of the request.

(5) Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

(6) Compliance with a request for access to personal data shall be free of charge.