Your organisation has appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.
Best Practice
Your organisation takes proportionate and reasonable steps to check the accuracy of the personal information held and, if necessary, is able to rectify it.
If your organisation is satisfied that the data is accurate, there is a procedure to explain this to the individual. The entity will need to inform the individual of their right to complain, and as a matter of good practice, record on the system the fact that the individual disputes the accuracy of the information.
If personal information has been disclosed to others, your organisation contacts each recipient to inform them about the rectification, unless this is impossible or involves disproportionate effort.
If asked, there is a process in place to inform the individual of the third parties that have received the personal information.
Accountability Check
Would team members say there are effective processes in place to rectify inaccurate or incomplete personal data?
Would requesters say they were given clear information about the actions the organisation took?