They said this… · Data protection & SARs

“Our system says the data is correct, so we will not rectify it”

Generally incorrect

A controller should take reasonable steps to assess a substantiated accuracy challenge; the existing system entry is not self-proving.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • Provide objective evidence of the correct fact where possible.
  • Some disputes concern opinion rather than objectively verifiable fact and may need contextual recording rather than deletion.
  • Restriction can sometimes be relevant while accuracy is verified.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.