Schedule 1 DPP6 Data Access and Correction Principle establishes a data subject right to (a) ascertain whether a data user holds personal data of which he is the subject, (b) request access to personal data within reasonable time + fee + form + manner, and (c) request correction of inaccurate personal data. Operationalised through statutory Data Access Request (DAR) regime under Sections 18-28A: prescribed form (DAR Form OPS003), 40-day response timeframe, prescribed fee not exceeding cost of compliance, compliance period extendable in limited cases, statutory exemptions (security + immigration + crime + legal professional privilege + statistical research + judicial + emergency). Data Correction Request (DCR) regime under Sections 22-25: request correction of inaccurate data, 40-day response, refusal grounds + reasons in writing + log statement attached to data if correction refused. Complaints handling: data subject complaint to data user first (best practice), escalation to PCPD via online + paper complaint form, PCPD investigation + mediation + enforcement notice + criminal prosecution + Administrative Appeals Board appeal. PCPD Compliance Check + Investigation Report + Court Judgment + AAB decisions corpus published. HK PDPO DPP6 + DAR + DCR + 40-day + Section 18-28A + complaints + PCPD applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.