May extend response period by two months if justified

Provide information in transparent, accessible form with clear language

Provide information in writing or other means including electronic

Provide information orally when requested if identity verified

Facilitate exercise of data subject rights

Cannot refuse to act unless unable to identify data subject

Provide information on action taken within one month

Inform data subject of extension within one month with reasons

Provide electronic response to electronic requests unless otherwise requested

Inform data subject of reasons for not taking action within one month

Provide information and communications free of charge