You should ensure that you take reasonable steps to safeguard the accuracy of the personal data you collect and deal with challenges to its accuracy from individuals about whom you have recorded information. What you consider to fall under these categories will change over time and as your business needs change.
You should have processes in place to ensure that you remove personal data which is inaccurate or out of date from records on a regular basis. This will enable you to amend, remove or clarify personal data you hold when appropriate.
Data you collect, store and process should be adequate, relevant and limited to what is necessary. If you do not make decisions about what personal data you should hold for your business purposes then you are at risk of collecting excessive data and infringing the privacy of an individual, or you may hold too little to make effective decisions about those individuals. Again what is adequate, relevant and not excessive will change with your business need.
Under the GDPR individuals have the right to have personal data rectified if it is inaccurate or completed if it is incomplete. You should have appropriate systems in place to deal with individuals’ requests to correct or complete information, or to allow individuals to provide a supplementary statement.
You need to have processes in place that enable you to restrict personal data if required. You should use methods of restriction that are appropriate for the type of processing you are carrying out.
The GDPR suggests a number of different methods that you could use to restrict data, such as:
- temporarily moving the data to another processing system;
- making the data unavailable to users; or
- temporarily removing published data from a website.
It is particularly important that you consider how you store personal data that you no longer need to process but the individual has requested you restrict (effectively requesting that you do not erase the data).
If you are using an automated filing system, you need to use technical measures to ensure that you cannot carry out any further processing or change the data whilst the restriction is in place. You should also note on your system that the processing of this data is restricted.