Data Accuracy
Making sure personal data is complete, accurate and consistent.
Data accuracy means the personal data you hold is correct, complete and up to date enough for what you use it for. It matters most when the data is used to make decisions about a person.
Meaning of Data Accuracy
Where data is used to make a decision about a person, or is shared with another fiduciary, the Data Fiduciary must make reasonable efforts to keep it complete, accurate and consistent. Errors in credit, insurance or hiring data can hurt people directly.
Section 8(3) of the DPDP Act sets the duty. Where personal data is likely to be used to make a decision that affects the Data Principal, or is likely to be disclosed to another Data Fiduciary, the Fiduciary processing it must ensure its completeness, accuracy and consistency. The language is about ensuring quality, not about promising perfection. The standard that follows from it is reasonable, documented effort proportionate to the risk of harm from an error.
The trigger is important. A name in a newsletter list that is misspelt rarely harms anyone. A wrong repayment status that is reported to a credit bureau, a wrong date of birth that changes an insurance premium, or a wrong employment record that results in a rejected job offer can change someone's life. That is why the Act focuses on data used for decisions and on data passed on to others, where mistakes spread and are hard to recall.
Accuracy works alongside the Section 12 right to correction, completion and updating. When a Data Principal asks, the Fiduciary must correct inaccurate or misleading data, complete incomplete data and update it. Accuracy is therefore a duty you carry on your own initiative and also a duty you carry when asked. Notice that the Section 12 right applies to processing based on consent, so an organisation should still have an internal approach for data held on other grounds.
Two limits are worth noting. The Central Government may notify certain classes, including start-ups, as exempt from Section 8(3) under Section 17(3), and research and statistical processing that does not lead to individual decisions can fall under Section 17(2). Also, accuracy is separate from sectoral rules: credit information companies under RBI regulation have their own dispute-resolution timelines, and these continue to apply next to the DPDP duty. Ensuring accuracy also covers synthetic and inferred data, such as scores produced by a model, since those too can drive decisions.
Examples of Data Accuracy
A lender corrects a wrong repayment record before sending it to a credit bureau.
A non-banking finance company finds that a customer's fully paid loan still shows as overdue. Before the next monthly upload to a credit bureau, the collections team fixes the record, tells the bureau to update it and informs the customer that it has been done.
A health insurer sees that policyholders' dates of birth entered by agents contain errors that change premiums. It adds a check against identity documents at proposal stage and runs a one-time clean-up, with letters to those whose premium changed.
A school's admission system holds two guardians' phone numbers per student. A teacher notices that emergency messages go to old numbers, so the school adds a yearly "confirm your details" step at fee payment and records each confirmation.
Why Data Accuracy matters
Wrong data causes real harm: a loan refused because of a bureau error, a patient given the wrong medication history, an employee flagged in a background check by mistake. Under the DPDP framework the Fiduciary remains responsible, and a failure to meet Section 8(3) falls under the general penalty head of up to ₹50 crore. If the inaccuracy comes from poor security, such as altered records, the exposure can reach the ₹250 crore head for security safeguards.
For the business, accurate data is a quality asset. It lowers returned mail and failed deliveries, avoids duplicate accounts, reduces complaints to the grievance officer and gives analytics and AI models a cleaner base. Inaccurate data also undermines the credibility of any evidence you may later produce to the Board.
How it works in practice
- 1Identify the datasets used for decisions (credit, pricing, eligibility, hiring, claims, access) and the datasets shared with other Fiduciaries. These are the priority for accuracy controls.
- 2Validate data at entry. Use format checks for PAN, PIN codes, phone numbers and dates, use dropdowns where possible, and offer self-service profile editing so that people can fix their own details.
- 3Set up periodic refresh. Ask customers to confirm key details at sensible intervals, and run duplicate detection and matching routines to keep one consistent record per person.
- 4Create a correction workflow with an owner, a deadline and a rule to pass corrections to processors and to recipients you have already sent the data to.
- 5Test automated decisions. Where a model or rule engine uses personal data, sample the outputs, check for data errors that drive wrong outcomes and keep a record of the checks.
- 6Maintain an audit trail of changes, who made them and why, so you can show how an error was found and fixed.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Thinking accuracy only matters when a person complains. The duty in Section 8(3) is proactive for decision data, so build checks in advance.
Correcting the main database but not the copies in the CRM, the data warehouse or the vendor system. Correct all linked copies.
Relying on unverified third-party data purchased in bulk. If you use it to decide about people, you carry the accuracy duty for it.
Refusing a correction because the old data was "what the customer gave us". If it is inaccurate or misleading, Section 12 requires correction.
Compliance tips
Rank your datasets by the harm an error could cause and spend your effort on the top few, instead of trying to perfect every field.
Give customers and employees an easy way to see and update their own information, and make that path visible in the notice and the app.
Write a short data-quality standard for each critical dataset: owner, sources, validation rules and refresh cycle.
When you correct data you have shared with others, send them the update and keep proof, since the correction is incomplete until the recipients have it.
Common questions about Data Accuracy
Does the DPDP Act require personal data to be accurate?
Yes, in specific situations. Section 8(3) requires completeness, accuracy and consistency where the data is likely to be used to make a decision affecting the person or is disclosed to another Data Fiduciary. Section 12 separately lets individuals ask for corrections.
Is data accuracy the same as the right to correction?
They are related but different. Accuracy is the organisation's own duty to keep data reliable. The right to correction under Section 12 is the person's ability to ask for errors to be fixed. A good compliance programme handles both through one process.
What counts as reasonable effort to keep data accurate?
The Act does not define a fixed test. Reasonable effort is usually judged by the risk: more checks for data that drives important decisions, fewer for low-impact data. Validation at entry, periodic refresh, correction workflows and documented controls are common signs of effort.
Who is responsible if my vendor holds inaccurate data?
You are. Section 8(1) keeps the Data Fiduciary responsible for processing done on its behalf by a processor. The contract should require the vendor to apply corrections quickly and to pass on error reports so you can meet your own duty.