Data Subject Requests for Amendment or Correction

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    Individuals cannot request amendments or corrections to their data.

    Example Strategies

    • Identify individuals who can perform such functions in an ad hoc or as needed basis until permanent individuals are appointed.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Informal requests for corrections might be made, but there's no standardized process or clear outcome.

    Example Strategies

    • Draft a preliminary policy for contesting record accuracy.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    A basic form or procedure for amendment requests exists, but responses are inconsistent, or the process for verification and implementation of changes is unclear.

    Example Strategies

    • Formalize a procedure to contest all "identifiable individual" info.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    A formal, documented, and consistently applied process for individuals to request amendment or correction of their personal data is in place, as required by Utah Code § 63A-19-403, with clear communication of decisions and reasoning.

    Example Strategies

    • Analyze root causes of correction requests to improve data entry.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity tracks the number of amendment requests, the types of data corrected, and the time taken to resolve requests, using this data to improve data quality and the request handling process.

    Example Strategies

    • Implement an immutable ledger for record contestations.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    The process for data amendment is largely automated where feasible, allowing for efficient review and update of personal data based on verified requests, improving data accuracy and individual control.