LexLint

Know the law your code answers to.

Law / Frameworks / NIST Privacy Framework / Control-P

NIST Privacy Framework, Control-PCT.DM-P3

Data elements can be accessed for alteration.NIST Privacy Framework, version 1.0, January 2020, CT.DM-P3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of .

18
laws
18
places
0
with court rulings behind them
4
not yet in force

The same ground elsewhere linked through the kinds of duty both controls are mapped from

A law in force is unmarked; the rest wear their state: not yet in force

  • Andorra
  • Antigua and Barbuda
  • Colombia
  • Democratic Republic of the Congo
  • Egypt
  • El Salvador
  • Ethiopia
  • Gambia
  • Grenada
  • Jamaica
  • Kosovo
  • Monaco
  • Nigeria
  • North Macedonia
  • Saint Kitts and Nevis
  • Serbia
  • Trinidad and Tobago
  • Tunisia

Data subject rights

16 laws, 16 places
PlaceLawWhat it asks, as read here
Andorra LQPD, rights of the data subject

Correct inaccurate or incomplete personal data on request without undue delay, and pass the correction on to recipients the data were disclosed to.
Antigua and Barbuda Data Protection Act, 2013, notice and rights of data subjects

Correct personal data on a data subject's written application where it is incomplete, incorrect, misleading, excessive or irrelevant to the purpose it is held for, without obliterating the pre-amendment text of the document, or give written reasons for refusing and tell the data subject of the right to complain to the Information Commissioner within twenty-eight days.
Democratic Republic of the Congo Digital Code, Title III, rights of the data subject

Correct inaccurate, incomplete, ambiguous, outdated or unlawfully processed personal data on request and pass the correction on to every recipient within thirty days.
El Salvador Ley para la Protección de Datos Personales, rights of data subjects

Correct or update a data subject's personal data within twenty business days of the request, and block the data under review while you do.
Ethiopia Personal Data Protection Proclamation, rights of data subjects

Correct inaccurate, incomplete, misleading or out-of-date personal data on request, free of charge and without excessive delay, and pass the correction on to every other data controller or third party the data were disclosed to in the year before the request.
Gambia Personal Data Protection and Privacy Act, 2025, rights of the data subject from a date not yet set

Correct inaccurate or incomplete personal data on demand, and update your records without undue delay.
Grenada Data Protection Act, No. 1 of 2023, rights of data subjects from a date not yet set

Amend personal data on a data subject's application where it is incomplete, incorrect, misleading, excessive, or irrelevant to the purpose it is held for.
Jamaica Data Protection Act, 2020, rights of data subjects

Determine within 30 days of a rectification request whether the personal data is inaccurate, correct it where it is, and give notice to the individual and to everyone the data was disclosed to in the preceding twelve months.
Kosovo Law No. 06/L-082 on Protection of Personal Data, rights of the data subject

Correct inaccurate or incomplete personal data on request without undue delay.
Monaco Loi sur la Protection des Données Personnelles, droits de la personne concernée

Correct inaccurate or incomplete personal data without delay on request, including by adding a supplementary statement.
Show the other 6 laws
Nigeria Nigeria Data Protection Act, 2023, rights of a data subject

Give a data subject an effective opportunity to rectify their personal data on the platform you process it through, without requiring an affidavit or a newspaper publication where the correction aligns the data with their National Identification Number, and without charging them for an error that was not their fault.
North Macedonia Law on Personal Data Protection (LPDP), rights of the data subject

Once Chapter III takes effect, rectify inaccurate personal data within 15 days of a request under Article 20.
Saint Kitts and Nevis Data Protection Act, 2018, rights of data subjects from a date not yet set

Correct personal data a data subject claims in writing is incomplete, incorrect, misleading, excessive, or irrelevant once satisfied of the claim, or tell the data subject of your refusal, your reasons, and their right to complain to the Information Commissioner within twenty eight days.
Serbia Law on Personal Data Protection, rights of the data subject

Correct a person's inaccurate personal data without undue delay on request, and let them complete incomplete data, including by providing a supplementary statement.
Trinidad and Tobago Data Protection Act, 2011, rights of access and correction from a date not yet set

Once Part III is in force, on a correction request either correct the personal information or annotate it with the requested correction, and notify any other public body or third party the information was disclosed to in the year before the request.
Tunisia Organic Act on the Protection of Personal Data, rights of the data subject

Flag personal data as disputed for as long as its accuracy is contested.

Comprehensive regime

2 laws, 2 places
PlaceLawWhat it asks, as read here
Colombia Ley 1581 de 2012, General Personal Data Protection

As a data processor, keep personal data secure in the same way, update or correct it as the controller instructs within five business days, and adopt an internal manual of policies and procedures for handling consultations and claims.
Egypt Law No. 151 of 2020 Promulgating the Personal Data Protection Law

Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.