Data Quality and Accuracy (CDPSE – Data Life Cycle Management)
Data Quality and Accuracy: A Complete Guide for the CDPSE Exam
1. Introduction
Data quality and accuracy is a core topic in the Data Life Cycle Management part of the ISACA Certified Data Privacy Solutions Engineer (CDPSE) exam. The exam looks at data quality through a privacy lens. Personal information must be accurate, complete, current and relevant to the purpose for which it is processed. Poor-quality personal data is not only a business problem. It is a privacy risk, a compliance violation and a potential source of harm to data subjects.
2. Why Data Quality and Accuracy Is Important
Legal and regulatory obligations
Most privacy frameworks make data quality an explicit requirement:
- GDPR Article 5(1)(d), the accuracy principle: personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to erase or rectify inaccurate data without delay.
- GDPR Article 16, the right to rectification: data subjects can demand that inaccurate data be corrected and incomplete data be completed.
- OECD Privacy Guidelines, the Data Quality Principle: personal data should be relevant to its purpose and accurate, complete and kept up to date.
- APEC Privacy Framework, Generally Accepted Privacy Principles (GAPP) and the Fair Information Practice Principles (FIPPs): all include data quality or integrity as a principle.
- Sector laws: the US Fair Credit Reporting Act (FCRA) requires reasonable procedures to assure maximum possible accuracy. HIPAA requires the integrity of health information.
Harm to individuals
Inaccurate data can cause real harm, including:
- wrongful denial of credit, employment, insurance or services;
- misdiagnosis or incorrect medical treatment;
- discriminatory or unfair automated decisions;
- disclosure of information to the wrong person, for example a letter sent to an outdated address, which is itself a privacy breach.
Organizational impact
Poor data quality also hurts the organization:
- poor business decisions and flawed analytics;
- biased AI and machine-learning models ('garbage in, garbage out');
- regulatory fines and reputational damage;
- higher cost of handling data subject requests and remediation.
Link to data minimization and retention
Keeping more data, or keeping it longer than necessary, increases the chance that it becomes stale and inaccurate. Good data quality supports, and is supported by, data minimization and defined retention periods.
3. What Data Quality and Accuracy Is
Data quality is the degree to which data is fit for its intended purpose. Common dimensions include:
- Accuracy: data correctly reflects the real-world entity or event, for example the correct date of birth.
- Completeness: all required data elements are present.
- Consistency: data does not conflict across systems or records.
- Timeliness / currency: data is up to date and available when needed.
- Validity: data conforms to defined formats, types and business rules.
- Uniqueness: there are no unintended duplicate records.
- Integrity: data is protected from unauthorized or accidental alteration and stays traceable across its life cycle.
- Relevance: data is pertinent to the stated processing purpose, which ties closely to purpose limitation.
Key distinction: Data integrity, in the security sense of the CIA triad, is about preventing unauthorized modification. Data quality/accuracy is broader: it asks whether the data is correct and fit for purpose, even if no one tampered with it.
4. How Data Quality Works Across the Data Life Cycle
a) Collection / Creation
- Collect directly from the data subject where possible, since this is the most reliable source.
- Use input validation such as format checks, range checks, mandatory fields, drop-down lists and check digits.
- Verify identity and data where appropriate, for example email confirmation or address verification services.
- Collect only what is needed. Data minimization reduces the surface for inaccuracy.
- Record the source and date of collection (data provenance/lineage).
b) Storage and Processing
- Maintain a data inventory and data flow maps so you know where personal data lives.
- Define master data management (MDM) and a single source of truth to avoid inconsistencies.
- Apply processing controls such as reconciliation, control totals, edit checks and error logs.
- Use integrity controls: hashing, checksums, access controls, change logs and audit trails.
- Run data profiling and cleansing, including de-duplication and standardization.
c) Use and Sharing
- Confirm data is still accurate and relevant before using it for decisions, especially automated decisions.
- When sharing with third parties or processors, include accuracy obligations in contracts.
- Notify recipients of corrections. Under GDPR Article 19, controllers must communicate rectification or erasure to each recipient unless this is impossible or involves disproportionate effort.
d) Maintenance and Updating
- Run periodic reviews and refresh cycles.
- Provide self-service portals so data subjects can view and update their information.
- Run a defined process for rectification requests: verify the requester, assess the claim, correct the data, propagate the correction and respond within statutory timelines.
- If accuracy is contested, GDPR Article 18 allows the data subject to request restriction of processing while accuracy is verified.
e) Archiving, Retention and Disposal
- Data kept beyond its retention period tends to become inaccurate and adds risk.
- Securely dispose of data that is no longer needed rather than keeping outdated records.
5. Governance and Roles
- Data owner: accountable for the quality of a data set and for defining quality requirements. In most exam scenarios this is the business, not IT.
- Data steward: handles day-to-day quality management, standards and issue resolution.
- Data custodian (IT): implements the technical controls.
- Privacy officer/DPO: ensures privacy principles, including accuracy, are embedded and monitored.
- Supporting artifacts: data quality policy, data quality metrics/KPIs (such as error rates and duplicate rates), data quality dashboards, and data governance frameworks such as DAMA-DMBOK and ISO 8000.
6. Data Quality and Privacy Engineering
- Privacy by design: build validation, minimization and update mechanisms into systems from the start.
- Privacy impact assessments (PIAs/DPIAs): evaluate risks arising from inaccurate data, especially in profiling and automated decision-making.
- AI/ML: training data quality affects fairness and bias. Under GDPR Article 22, safeguards for automated decisions include human review.
- De-identification: anonymization or pseudonymization may reduce data utility. Balance privacy protection against data quality needs.
- Data lineage tools: trace where data came from and how it was transformed, which helps correct errors at their source.
7. Exam Tips: Answering Questions on Data Quality and Accuracy
Tip 1: Fix the root cause, not just the symptom. If a scenario describes recurring inaccurate data, the best answer usually addresses the source. That means input validation at collection, process redesign or upstream system correction. Correcting individual records only treats the symptom.
Tip 2: Prefer preventive controls over detective and corrective ones. Input validation and edit checks at the point of entry are generally preferred over after-the-fact reconciliation. Detective controls still matter for monitoring, though.
Tip 3: The data subject is often the best source of accurate data. Answers that let individuals review and correct their own data, through self-service portals or rectification processes, align with privacy principles.
Tip 4: Know who is accountable. The data owner is accountable for data quality. IT or custodians implement controls but are not ultimately accountable. Choose the business owner when asked who defines quality requirements or accepts risk.
Tip 5: Propagate corrections. When data is rectified, it must be updated in all systems and with third parties to whom it was disclosed. Look for answers that include notifying recipients and updating backups or downstream systems where feasible.
Tip 6: Link accuracy to minimization and retention. If the question involves old, stale or excessive data, the best answer may be to apply retention schedules or delete unneeded data rather than spend effort keeping it accurate.
Tip 7: Watch for 'FIRST' and 'BEST' wording. 'FIRST' often points to understanding the situation, such as identifying the data, reviewing the inventory or assessing the impact, before acting. 'BEST' points to the most effective, sustainable control.
Tip 8: Distinguish integrity from accuracy. If the scenario is about unauthorized changes, think integrity controls such as access control, hashing and logs. If it is about outdated or wrong information, think quality processes such as validation, updating and rectification.
Tip 9: Consider automated decision-making risk. In questions about profiling, scoring or AI, inaccurate data leads to unfair outcomes. Strong answers include data quality checks, bias testing, DPIAs and human review.
Tip 10: Remember the restriction right. When a data subject disputes accuracy, processing may need to be restricted during verification. Do not simply continue processing, and do not automatically delete.
Tip 11: Verify identity before rectification. Changing data at the request of an unverified person can cause a privacy breach, such as account takeover. The correct process always includes identity verification.
Tip 12: Think life cycle. Map the question to the life cycle stage it describes (collection, processing, use, sharing, retention or disposal). Then pick the control appropriate to that stage.
8. Sample Question Walk-Through
Question: An organization discovers that customer addresses in its CRM are frequently incorrect, causing statements to be mailed to the wrong recipients. Which of the following is the BEST way to address this issue?
A. Run a quarterly data cleansing project
B. Implement address validation at the point of data entry and allow customers to update their details online
C. Encrypt the CRM database
D. Notify the supervisory authority
Answer: B. It is preventive, addresses the root cause and uses the data subject as an accurate source.
- A is corrective and periodic, so it does not prevent new errors.
- C addresses confidentiality, not accuracy.
- D may be needed if a reportable breach occurred, but it does not fix the problem.
9. Key Takeaways
- Data accuracy is a legal privacy principle, not just an IT concern.
- Quality dimensions include accuracy, completeness, consistency, timeliness, validity, uniqueness, integrity and relevance.
- Embed quality controls at every life cycle stage, especially at collection.
- Support data subject rights to access, rectification and restriction.
- Data owners are accountable, stewards manage and custodians implement.
- On the exam, choose preventive, root-cause, sustainable and privacy-respecting answers.
