v. in the interests of national security; (d) compliance would prejudice a lawful purpose of the collection; (e) compliance is not reasonably practicable in the circumstances of the particular case; or (f) the information shall – i. not be used in a form in which the data subject may be identified; or ii. be used for historical, statistical or research purposes. (5) A data controller shall process personal information only upon notification to the commission. Access to and challenges of personal information 26. (1) A data subject who provides adequate proof of identity, shall have a right to request (a) A data controller to confirm, free of charge, whether or not the data controller holds personal information about the data subject; and (b) from a data controller, personal information about the data subject held by the data controller, including information about the identity of all third parties who have or have had, access to the information – i. within a prescribed time; ii. at a prescribed fee; iii. in a reasonable manner and format; and iv. in a form that is generally understandable. (2) Where the data controller denies a data subject a request made in terms of subsection (1) above, the data subject shall be entitled to be iven written reasons for the denial.