A Data Principal has the right to correction, completion, updating and erasure of her personal data, for processing to which she has previously given consent.
On receiving a request, the Data Fiduciary must correct inaccurate or misleading personal data, complete data that is incomplete, and update data that is out of date.
On a request for erasure, the Data Fiduciary must erase the personal data unless retention is necessary for the specified purpose or for compliance with any law in force.
The right runs against the Data Fiduciary that holds the data, which is why section 8 requires it to be able to say what it holds and why.
On refusing a valid request
a breach of the Act. Retention has to be justified by the specified purpose or by a law. A general preference for keeping records is neither.
Where people go wrong
Refusing erasure because the data might be useful later. The exception is retention necessary for the purpose or required by law, not retention that would be convenient.
Correcting the record in one system and leaving it stale in the others. The obligation attaches to the personal data, not to whichever database was easiest to reach.
Treating a correction request as a complaint to be closed. It is a statutory right with a statutory response.
Asking the person to prove the data is wrong before acting. The section requires correction of inaccurate or misleading data on request.
Common questions
Can a customer require a business to delete their personal data?
Yes. Section 12 gives a Data Principal the right to erasure, and the Data Fiduciary must erase unless retaining the data is necessary for the specified purpose or for compliance with a law in force.
What is the difference between erasure under section 12 and under section 8?
Section 12 is a right the Data Principal exercises by making a request. Section 8 imposes a duty to erase once consent is withdrawn or the purpose is no longer served, whether or not anybody asks.
Can a business refuse to correct data it believes is accurate?
The section requires correction of inaccurate or misleading data on request. A dispute about accuracy does not remove the obligation to deal with the request, and the grievance route under section 13 remains open to the person.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.