; and (C) shall not be required to act on a request under this section if the covered entity is unable to fulfill the request because— (i) the covered entity requires the assistance of a service provider to fulfill the request; and (ii) the service provider has informed the covered entity that the service provider is unable to assist the covered entity in fulfilling the request for a reason specified in section 8(c)(3)(A)(ii)(IV). (2) Notice of reasons for declination If the covered entity declines to act on a request pursuant to paragraph (1), the covered entity shall inform the individual who made the request of the reasons for such declination and any rights the individual may have to appeal the decision of the covered entity. (h) Exception for small businesses The requirements under subsections (b) and (c) shall not apply to a covered entity that is a small business. (i) Guidance The Commission shall, after consulting with and soliciting comments from consumer data industry representatives, issue guidance describing nonbinding best practices for covered entities and service providers of different business sizes and types to develop privacy controls as described in this section. 6. Security (a) In general Each covered entity and service provider shall develop, document, implement, and maintain a comprehensive data security program that contains reasonable administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of personal data from unauthorized access, use, destruction, acquisition, modification, or disclosure. (b) Considerations of safeguards The safeguards required under subsection (a) with respect to a covered entity or service provider shall be appropriate to— (1) the size, complexity, and resources of the covered entity or service provider; (2) the nature and scope of the activities of the covered entity or service provider