; or (IV) informing the covered entity that— (aa) the service provider does not hold any personal data related to the request; (bb) the service provider cannot reasonably access any personal data related to the request; or (cc) complying with the request would be inconsistent with a legal requirement to which the service provider is subject. (B) Deletion of data upon completion of service Except as otherwise required by law, as soon as practicable after the completion of the service or function for which a service provider collected or processed personal data on behalf of a covered entity, the service provider shall delete, de-identify, or return to the covered entity all such personal data. (C) Assurance of compliance (i) In general Subject to clause (ii), a service provider shall make available to a covered entity on whose behalf the service provider collects or processes personal data information necessary to demonstrate the service provider's compliance with subparagraph (A). (ii) Written representation of compliance If the information described in clause (i) is not technically available to a service provider, the service provider may comply with clause (i) by providing the covered entity with a written representation stating that the service provider is in compliance with subparagraph (A). (4) Subcontractor requirements A service provider that is collecting or processing personal data on behalf of a covered entity shall not employ a subcontractor to carry out or assist in such collection or processing unless— (A) the service provider has provided the covered entity with an opportunity to object to the use of such subcontractor