Requirement
The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity’s objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity’s objectives related to privacy.
Points of Focus
Responds to Data Controller Requests [P]
Requirement: The entity has a process to respond to data subject requests received from data controllers in accordance with service agreements and privacy objectives. Such process may include authentication of the request, permitting access where appropriate, responding within a reasonable time, and notification if the request is denied.
Authenticates Data Subjects’ Identity [P][C]
Requirement: The identity of data subjects who request access to their personal information is authenticated before they are given access to that information.
Permits Data Subjects Access to Their Personal Information [P][C]
Requirement: Data subjects are able to determine whether the entity maintains personal information about them and, upon request, may obtain access to their personal information.
Provides Understandable Personal Information Within Reasonable Time [P][C]
Requirement: Personal information is provided to data subjects in an understandable form, in a reasonable time frame, and at a reasonable cost, if any.
Informs Data Subjects If Access Is Denied [P][C]
Requirement: When data subjects are denied access to their personal information, the entity informs them of the denial and the reason for the denial in a timely manner, unless prohibited by law or regulation.
Explanation
People have the right to see the personal information an organization holds about them and to receive a copy on request. Auditors check that the organization verifies who is asking, responds within a reasonable time, and clearly explains any refusal, since mishandled access requests are a common source of privacy complaints and regulatory findings.
