(3) A data subject shall have a right to challenge the written reasons for denail or requests made in terms of subsection (1). (4) If, in accordance with subsection (1) (b), personal information is communicated to a data subject, the data subject shall be advised of the right in terms of section 27 to challenge the correctness of the information. Correction of personal information 27. (1) A data subject shall free of charge have a right to challenge the correctness of information by requesting that a data controller (a) correct or delete personal information about the data subject in its possession or under its control that is innacurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or (b) destroy or delete a record of personal information about the data subject that the data controller is no longer authorised to retain. (2) A data controller shall, on receipt of a request in terms of subsection (1), take reasonable steps to investigate the challenge lodged and – (a) correct, destroy or delete the information; or (b) provide that data subject, with credible evidence in support of the correctness of the information. (3) Where credible evidence has been provided under subsection (2) (b), the data subject may apply to the Commission to investigate the disputed information. (4) Where the data controller has taken steps under subsection (2)(a) that result in a change to the information and the changed information has an impact on decisions that have been or will be taken in respect of the data subject in question, the data controller shall, within 7 working days, inform each person of