---

id: "PM-22" title: "Personally Identifiable Information Quality Management" family: "PM" family_name: "Program Management" sort_id: "pm-22" priority: "P1" implementation_level: "organization"

---

Statement

Develop and document organization-wide policies and procedures for:

Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;

Correcting or deleting inaccurate or outdated personally identifiable information;

Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and

Appeals of adverse decisions on correction or deletion requests.

Guidance

Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information.

The senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations.

Organizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem.

Assessment Objective: organization-wide policies for personally identifiable information quality management are developed and documented;

Assessment Objective: organization-wide procedures for personally identifiable information quality management are developed and documented;

Assessment Objective: the policies address reviewing the accuracy of personally identifiable information across the information life cycle;

Assessment Objective: the policies address reviewing the relevance of personally identifiable information across the information life cycle;

Assessment Objective: the policies address reviewing the timeliness of personally identifiable information across the information life cycle;

Assessment Objective: the policies address reviewing the completeness of personally identifiable information across the information life cycle;

Assessment Objective: the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;

Assessment Objective: the procedures address reviewing the relevance of personally identifiable information across the information life cycle;

Assessment Objective: the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;

Assessment Objective: the procedures address reviewing the completeness of personally identifiable information across the information life cycle;

Assessment Objective: the policies address correcting or deleting inaccurate or outdated personally identifiable information;

Assessment Objective: the procedures address correcting or deleting inaccurate or outdated personally identifiable information;

Assessment Objective: the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;

Assessment Objective: the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;

Assessment Objective: the policies address appeals of adverse decisions on correction or deletion requests;

Assessment Objective: the procedures address appeals of adverse decisions on correction or deletion requests.

Privacy program plan

policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion

records of monitoring PII quality management practices

documentation of reviews and updates of policies and procedures

Organizational personnel with privacy program information dissemination responsibilities

organizational personnel with privacy responsibilities

[Organizational processes for data quality and personally identifiable information quality management procedures

mechanisms supporting and/or implementing quality management requirements