SOC 2 Correcting Personal Information (P5.2)

Overview:
The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy.

Action Items:
1) Create a privacy notice (externally facing) and privacy policy (internally facing) and publish on the company intranet for employees to access and review.
2) Inspect the privacy notice to determine that the company provides a means for users to contact the company to correct, amend, or append personal information.
3) Inspect the privacy notice to determine that the company provides alternative means of resolution available to customers if access to customer data was denied or responses to inquiries are not satisfactory.

Related Documents:
1) Privacy notice
2) Privacy policy

Additional Guidance:
The following points of focus highlight important characteristics related to this criterion:

1) Communicates Denial of Access Requests—Data subjects are informed, in writing, of the reason a request for access to their personal information was denied, the source of the entity's legal right to deny such access, if applicable, and the individual's right, if any, to challenge such denial, as specifically permitted or required by law or regulation.
2) Permits Data Subjects to Update or Correct Personal Information—Data subjects are able to update or correct personal information held by the entity. The entity provides such updated or corrected information to third parties that were previously provided with the data subject's personal information consistent with the entity's objective related to privacy.
3) Communicates Denial of Correction Requests—Data subjects are informed, in writing, about the reason a request for correction of personal information was denied and how they may appeal.