Requirement
The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy.
Points of Focus
Responds to Data Controller Requests [P]
Requirement: The entity has a process to respond to data controllers’ update requests, including updates to personal information and denial of requests, in accordance with service agreements to support the achievement of the entity’s objectives related to privacy.
Communicates Denial of Access Requests [P][C]
Requirement: Data subjects are informed, in writing, of the reason a request for access to their personal information was denied, the source of the entity’s legal right to deny such access, if applicable, and the individual’s right, if any, to challenge such denial, as specifically permitted or required by law or regulation.
Permits Data Subjects to Update or Correct Personal Information [P][C]
Requirement: Data subjects are able to update or correct personal information held by the entity. The entity communicates updates, corrections, and deletion requests to third parties that were previously provided with the data subject’s personal information consistent with the entity’s objectives related to privacy.
Communicates Denial of Correction Requests [P][C]
Requirement: Data subjects are informed, in writing, about the reason a request for correction of personal information was denied and how they may appeal.
Explanation
When someone points out that their personal information is wrong, the organization must fix it and pass the correction to any third parties who received the data. If it refuses, it must say why in writing. Auditors look for a working correction process, not just a policy on paper.
