SOC 2 P7.1: Privacy - Quality of Personal Information

Put data quality controls at every collection point. Validate inputs for accuracy and completeness when data first enters the system. Check email formats, phone number structures, postal addresses, and date ranges. Implement duplicate detection to prevent multiple records for the same person.

Give individuals self-service tools to review and update their own information. Account settings pages, profile management interfaces, and preference centres are the most scalable way to keep data accurate. If people can fix their own records, they will.

Schedule periodic data quality assessments. Use automated tools to catch common issues: duplicates, outdated records, invalid formats, and orphaned entries. Track data quality metrics over time so you can spot trends rather than just point-in-time problems.

Define validation rules for specific data elements. Verify that email addresses resolve, check mailing addresses against postal databases, confirm phone numbers are valid, and ensure dates fall within reasonable ranges. Apply these rules both during collection and periodically against existing records.

Create a clear remediation process. When quality issues surface, assess severity, prioritise, and correct. Some problems can be fixed automatically (standardising formats). Others need manual review or direct outreach to the individual. Track remediation work and verify corrections propagate across all systems.

Review data for continued relevance. Purposes change and time passes. Some personal data you hold may no longer serve any current legitimate purpose. Identify it, flag it, and apply your retention policies. Accumulating data you do not need is a liability, not an asset.