(a) Within 10 days of receipt of a request made under § 903.4 the Privacy Protection Officer shall determine whether access to the record is available under the Privacy Act and shall notify the requesting individual in person or in writing of that determination.

(b) Notices granting access shall inform the individual when and where the requested record may be seen, how copies may be obtained, and of any anticipated fees or charges which may be incurred under § 903.11. Access shall be provided within 30 days of receipt of the request unless the Corporation, for good cause shown, is unable to provide prompt access, in which case the individual shall be informed in writing within the 30 days as to the cause for delay and when it is anticipated that access will be granted.

(c) Notices denying access shall state the reasons for the denial, and advise the individual that the decision may be appealed in accordance with the procedures set forth in § 903.6.