Maintenance and accuracy
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Control measure: Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.
Risk: If people can't challenge inaccuracies, inaccurate information may be processed. This may breach UK GDPR article 5(1)(d).
Ways to meet our expectations:
- Document how to handle rectification requests in sufficient detail in policies, including who oversees the request process and how.
- Have a process to determine whether information is inaccurate, and how to correct it quickly or document the inaccuracy, if you can’t rectify it.
- Ensure policies have appropriate document and version control.
- Communicate policies to staff and make policies readily available for them to refer to.
- Keep policies up-to-date, particularly with any changes to data protection law.
Options to consider:
- Include specific processes for erasure requests within your policy about how to handle individual rights.
- Use reliable indexes, file content pages, and descriptions of documents to help locate paper records quickly.
- Use appropriate search functionality and metadata to help locate electronic records quickly.
Control measure: Processes are in place to inform third parties quickly if inaccurate information has been shared with them.
Risk: If third parties aren't informed quickly when inaccuracies are identified, they may process inaccurate information further. This may breach UK GDPR article 5(1)(d).
Ways to meet our expectations:
- Have a process to inform third parties about any request for rectification, if you have shared inaccurate personal information with them.
- Document responsibilities and processes for rectification requests in contracts with processors.
- Document responsibilities for rectification requests in sharing agreements with other controllers.
- Measure performance and compliance metrics or key performance indicators for rectification requests (eg the number of requests received and the time taken to inform third parties).
Options to consider:
- Include specific processes for rectification requests within your policy about how to handle individual rights.
- Track the number or percentage of requests where you identified inaccurate information, and feed this into data quality processes or staff awareness exercises.
Control measure: The quality of information held in records or systems is reviewed regularly to ensure it is adequate for its purpose.
Risk: If the information processed is not checked regularly, it may be inadequate or poor quality. This may breach UK GDPR article 5(1)(c).
Ways to meet our expectations:
- Complete data quality reviews to confirm that information is still accurate, adequate and not excessive for the purpose you are processing it for.
- Take appropriate actions to resolve data quality issues and update processes and staff after reviews.
Options to consider:
- Document data quality reviews in your internal audit programme.
- Use standard formats or system validation rules to ensure you collect quality information.
- Set up automated alerts for information that doesn’t meet data quality requirements.
- Generate system reports of missing or incorrectly formatted information and report to senior managers regularly.
Further reading
Control measure: There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.
Risk: If staff are not aware about the importance of data quality, data quality issues may continue or worsen. This may breach UK GDPR articles 5(1)(c-f), 5(2), and 32.
Ways to meet our expectations:
- Train new staff on data quality at induction and refresh training periodically.
- Communicate data quality issues to staff to raise awareness (eg using posters, team meetings, reminder emails, and newsletters).
- Provide feedback quickly to relevant staff on findings from data quality reviews.
Options to consider:
- Review data quality training content regularly to keep it up-to-date.
- Communicate regular data quality reminders or run data quality awareness campaigns covering common issues.