DAT-020 Accuracy of Personal Data
Description
Processes exist to ensure that personal data held is accurate and, where necessary, kept up to date. Inaccurate data is corrected or deleted without delay. Users or data subjects have mechanisms to update their own data, and accuracy is considered when designing data collection pipelines.
Rationale
Inaccurate data can cause material harm to individuals (e.g. incorrect AI decisions). GDPR requires accuracy as a data quality principle and backs it with an enforceable right to rectification.
Applicability (9 profiles)
Framework Mappings (7)
| GDPR-Art.16 | Right to Rectification | informative |
| GDPR-Art.5.1d | Accuracy of Personal Data | full |
| PM-22 | Personally Identifiable Information Quality Management | full |
| SI-12 | Information Management and Retention | informative |
| SI-18 | Personally Identifiable Information Quality Operations | full |
| P5.2 | Correction of Personal Information | informative |
| P7.1 | Quality of Personal Information | full |
Evidence (2)
Rectification request log and data correction records showing that inaccurate personal data is corrected promptly upon request or detection.
Example: DSR tracker entries for rectification requests (Jira / OneTrust) from the last 12 months, each showing: request date, data corrected (field/system), completion date, confirmation sent to data subject, and systems updated (primary DB, backups, downstream systems)
Test: Request the rectification request log. Verify: (1) all rectification requests were actioned within 30 days, (2) corrections were applied to all systems holding the inaccurate data (not just the primary record), (3) data subjects received confirmation of correction, (4) no requests were refused without documented legal justification.
User-facing account or profile settings demonstrating that users can update their own personal data directly in the product without requiring a formal request.
Example: Product UI screenshot or user settings documentation showing self-service edit capability for core personal data fields (name, email, address, contact details) in the user's account settings page
Test: Access the product as a standard user. Verify: (1) the account/profile settings page allows users to edit their own core personal data fields directly, (2) changes are reflected in the system immediately or within a stated processing period, (3) the user receives confirmation of changes, (4) the self-service mechanism is linked from or referenced in the privacy notice.
Questions (2)
Does your organisation have a process to keep the personal data it holds accurate?
Users should be able to update their own core personal data fields (name, email, contact details) directly in the product without requiring a formal request. Corrections should propagate to all systems holding the inaccurate record.
How are inaccurate personal data records identified and corrected?
Self-service correction capability alongside a formal rectification request process provides the strongest coverage. Corrections must propagate to all systems (primary database, downstream systems, backups where applicable) to be effective.