It shall also be stated in the agreement with the controller that the processor undertakes to carry out such security measures as ensue from section 13. Section 16 Time limit for replying to inquiries regarding data, etc. The controller shall reply to inquiries regarding access or other rights pursuant to sections 18, 22, 25, 26, 27 and 28 without undue delay and not later than 30 days from the date of receipt of the inquiry. If special circumstances should make it impossible to reply to the inquiry within 30 days, implementation may be postponed until it is possible to reply. In such case, the controller shall give a provisional reply stating the reason for the delay and when a reply is likely to be given. Section 17 Payment The controller may not request compensation for providing data pursuant to Chapter III or for meeting demands of the data subject pursuant to Chapter IV. Chapter III Information on processing of personal data Section 18 Right of access Any person who so requests shall be informed of the kind of processing of personal data a controller is performing, and may demand to receive the following information as regards a specific type of processing: a) the name and address of the controller and of his representative, if any, b) who has the day-to-day responsibility for fulfilling the obligations of the controller, c) the purpose of the processing, d) descriptions of the categories of personal data that are processed, e) the sources of the data, and f) whether the personal data will be disclosed, and if so, the identity of the recipient. If the person requesting access is a data subject, the controller shall inform him of a) the categories of data concerning the data subject that are being processed, and b) the security measures implemented in connection with the processing insofar as such access does not prejudice security. The data subject may demand that the controller elaborate on the information in the first paragraph, litra a-f to the extent that this is necessary to enable the data subject to protect his or her own interests. The right to information pursuant to the second and third paragraphs shall not apply if the personal data are being processed exclusively for historical, statistical or scientific purposes and the processing will have no direct significance for the data subject. Section 19 Obligation to provide information when data is collected from the data subject When personal data is collected from the data subject himself, the controller shall on his own initiative first inform the data subject of a) the name and address of the controller and of his representative, if any b) the purpose of the processing,