Want to watch this video? Sign up for the course here. Or enter your email below to watch one free video.

Unlock This Video Now for FREE

This video is normally available to paying customers.
You may unlock this video for FREE. Enter your email address for instant access AND to receive ongoing updates and special discounts related to this topic.

Under the GDPR regulations “personal data shall be accurate and where necessary kept up to date. Every reasonable step needs to be taken to ensure that inaccurate personal data is erased or rectified without delay”. There is little difference from the 1998 data protection act, however, individuals now have a stronger right to have inaccurate personal data corrected under the right to rectification.

Organisations should make sure that they have processes to check both the accuracy of the data collected and the source of the data. They should also be able to identify when they need to keep the data updated, to fulfil the purpose and update it as necessary. Records of mistakes should be clearly identified as mistakes, and if records identify any matters of opinion, this should be clear where appropriate on whose opinion and if any relevant changes to the facts have been made.

Information about who to contact about updating data should be provided to data subjects on the Privacy Policy. Data held should be reviewed periodically to ensure that it is fit for the purpose for which it is used. Instructions on how to correct or update data via logins on websites should be provided to enable the data subject to review and update their own data where available.

Whether an organisation needs to keep data up to date does depend on what it uses the information for, if for example, an individual makes a one-off purchase the organisation may need to hold the information for accounting purposes, but there would be no justification in regularly checking to see, for example, if the customer has changed address.

Where the processing and relationship with the individual is ongoing and relies on data being accurate, in some cases it is reasonable to expect the individual to inform an organisation of, for example, a new address. If they do so then the data should be updated accurately.