Individuals must have access to personal information about them that an organization holds and be able to correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy in the case in question, or where the rights of persons other than the individual would be violated.
Lorsque des informations à caractère personnel sont transférées entre deux responsables du traitement au sein d'un groupe contrôlé d'entreprises ou d'entités, un contrat n'est pas toujours requis en vertu du principe «Responsabilité en cas de transfert ultérieur».