You want data about individuals for a range of reasons. Whatever those reasons are, it will be no good to your organisation if it is incorrect or out of date. Since the individual does not want to be treated on the basis of incorrect or out of date information, you and the individual are wanting the same thing – to correct and/or update the data held.
The individual can request such a change verbally or in writing – so again you need to ensure your staff are aware of their responsibilities on receiving such a request (recognise the request for what it is, ensure they record the details of the request, ensure they deal with the request or pass it to the relevant person in their organisation who will deal with the request).
As with a SAR, you:
- Should respond to a request without delay and at least within one month of receipt.
- Can extend the deadline by a further two months for complex or numerous requests so long as you contact the individual and inform them of the delay and the reasons for it.
- Must ensure you have checked the identity of the person making the request, using “Reasonable Means”. Where you have shared this individual’s data with another organisation, you must also inform the other organisation wherever possible – this is your responsibility not that of the individual.
It is good practice to check the accuracy of the data you process or keep in order to determine the frequency of taking action to update such data as may be required.
It is recommended that a Records Management Policy with instructions how to process such updates, and when, together with the requirements required for all data held, should be created and reviewed periodically.
Checking the data held is accurate on a periodic basis will help your organisation to be sure it is fit for purpose going forwards.
This should also include checks on the accuracy of data entry in the first place – as this is the point where most errors are likely to occur. Clearly if the data is entered by the individual as part of a form, then the accuracy is likely to be correct – so long as they have understood the requirements for what data is to be given and where recorded.
As with all such error detection checks, all issues identified should be communicated to all staff to ensure they are aware of the potential for problems and can avoid such instances going forwards.