In Regards to the Collection of Personal Data Conducted by an Organization

In regards to the collection of personal data conducted by an organization, what must the data subject be allowed to do?

A) Evaluate the qualifications of a third-party processor before any data is transferred to that processor
B) Obtain a guarantee of prompt notification in instances involving unauthorized access of the data
C) Set a time-limit as to how long the personal data may be stored by the organization
D) Challenge the authenticity of the personal data and have it corrected if needed