; (iii) the information was received from a whistleblower pursuant to section 23; (iv) the information was lawfully obtained from a foreign or domestic authority in connection with a confidential investigation by the Commission; or (v) the person has agreed to provide the Commission with access to the information. (C) Obligations of the recipient (i) Acknowledgement of receipt of request Within 3 business days after a person receives a request made in accordance with subparagraph (A) or a subsequent communication from the Commission in relation to the request, the person shall acknowledge to the Commission that the recipient has received the request or communication. (ii) Response to request Within 10 business days after a person receives such a request or communication, the person shall respond to the request or communication in accordance with subparagraph (D). (iii) Retention of requested records A person who receives such a request shall retain all records identified in the request until the request or any subpoena for the records has been resolved. (D) Response options of the recipient A person who receives such a request shall— (i) agree to, and comply with, the request; (ii) request the Commission to provide additional information regarding the request; (iii) request the Commission modify any aspect of the request; (iv) seek a review of any aspect of the request by the Commission or a division director to whom the authority to conduct such a review has been delegated; or (v) refuse the request. (5) Establishment of rules for safeguarding information provided to the Commission (A) In general The Commission shall prescribe rules regarding— (i) the retention of information provided to the Commission under this Act, including— (I) the manner of retention; (II) the duration of retention, which shall ensure that information is retained for only so long as is necessary to carry out this Act or other Federal law; and (III) the process for the return or destruction of the information, as appropriate