Data correction is required when the personal data held by a Controller is found to be inaccurate, incomplete, or outdated. Upon receiving a valid request from the Data Subject, the Controller must correct or update the data without undue delay. The Controller is also responsible for informing any third parties with whom the data was shared, if such notification is not unreasonably burdensome.

Erasure may be refused if retaining the data is necessary for compliance with a legal obligation, the establishment or defense of legal claims, or for reasons of public interest such as public health or scientific research. Additionally, if the data is anonymized or if erasure would infringe upon another person’s rights or freedoms, the Controller may deny the request while documenting the justification.

Once a valid erasure request is processed, the Controller must securely and permanently delete the data or anonymize it so that it can no longer be linked to the Data Subject. The Controller must also notify third parties who received the data unless this is disproportionate. The Data Subject should be informed that the erasure has been completed and provided with confirmation if requested.