How do I respond to a request to correct or delete information?

Individuals have a right to request the correction of any personal information(external link) you hold about them, including asking for their information to be corrected by removing or deleting it. If you decline to correct the information as requested, then the individual has the right to ask to have a statement of correction added to the information in question.

Once you receive a request for correction and/or a statement of correction, you have 20 working days to review the information in question and decide whether to make the correction requested.

You don’t necessarily have to make the correction if you consider that the information is already accurate, or there might be a good reason why you can’t change a historic record.

However, you should also keep in mind that you have an obligation to make sure personal information is accurate(external link) before using it and, as such, there could be issues leaving inaccurate or disputed information on someone’s file.

Once you’ve decided how you’ll respond to the request for correction, you should let the individual know if you’ll be making the correction or not. If not, you should let them know they have the right to provide you with a statement of correction if they haven’t done so already. The statement of correction needs to be kept attached to the information they asked to be updated, in a way that they will always be read together.

You should also let the individual know that they have the right to seek review of your decision not to correct the information, by making a complaint to us(external link).

When you have made a correction, or attached a statement of correction to personal information, you must also, so far as is reasonably practicable, inform every other person your organisation has disclosed the information to.

Updated September 2024