P5.2

P5.2

The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy.

Category

Privacy

Subcategory

Privacy Criteria Related to Access

Points of Focus

Responds to Data Controller Requests [P]

The entity has a process to respond to data controllers' update requests, including updates to personal information and denial of requests, in accordance with service agreements to support the achievement of the entity's objectives related to privacy.

Communicates Denial of Access Requests [P][C]

Data subjects are informed, in writing, of the reason a request for access to their personal information was denied, the source of the entity's legal right to deny such access, if applicable, and the individual's right, if any, to challenge such denial, as specifically permitted or required by law or regulation.

Permits Data Subjects to Update or Correct Personal Information [P][C]

Data subjects are able to update or correct personal information held by the entity. The entity provides informationcommunicates updates, corrections, and deletion requests to third parties that were previously provided with the data subject's personal information consistent with the entity's objectives related to privacy.

Communicates Denial of Correction Requests [P][C]

Data subjects are informed, in writing, about the reason a request for correction of personal information was denied and how they may appeal.