PM-22 Personally Identifiable Information Quality Management

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: PM-23, SI-18

Control statement

Develop and document organization-wide policies and procedures for:

• a. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
• b. Correcting or deleting inaccurate or outdated personally identifiable information;
• c. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
• d. Appeals of adverse decisions on correction or deletion requests.

NIST discussion

Personally identifiable information quality management includes steps that organizations take to confirm the accuracy and relevance of personally identifiable information throughout the information life cycle. The information life cycle includes the creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposition of personally identifiable information. Organizational policies and procedures for personally identifiable information quality management are important because inaccurate or outdated personally identifiable information maintained by organizations may cause problems for individuals. Organizations consider the quality of personally identifiable information involved in business functions where inaccurate information may result in adverse decisions or the denial of benefits and services, or the disclosure of the information may cause stigmatization. Correct information, in certain circumstances, can cause problems for individuals that outweigh the benefits of organizations maintaining the information. Organizations consider creating policies and procedures for the removal of such information.

The senior agency official for privacy ensures that practical means and mechanisms exist and are accessible for individuals or their authorized representatives to seek the correction or deletion of personally identifiable information. Processes for correcting or deleting data are clearly defined and publicly available. Organizations use discretion in determining whether data is to be deleted or corrected based on the scope of requests, the changes sought, and the impact of the changes. Additionally, processes include the provision of responses to individuals of decisions to deny requests for correction or deletion. The responses include the reasons for the decisions, a means to record individual objections to the decisions, and a means of requesting reviews of the initial determinations.

Organizations notify individuals or their designated representatives when their personally identifiable information is corrected or deleted to provide transparency and confirm the completed action. Due to the complexity of data flows and storage, other entities may need to be informed of the correction or deletion. Notice supports the consistent correction and deletion of personally identifiable information across the data ecosystem.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-22

Determine if:

• PM-22[01] organization-wide policies for personally identifiable information quality management are developed and documented;
• PM-22[02] organization-wide procedures for personally identifiable information quality management are developed and documented;
• PM-22a.
  • PM-22a.[01] the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[02] the policies address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[03] the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[04] the policies address reviewing the completeness of personally identifiable information across the information life cycle;
  • PM-22a.[05] the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[06] the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[07] the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[08] the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
• PM-22b.
  • PM-22b.[01] the policies address correcting or deleting inaccurate or outdated personally identifiable information;
  • PM-22b.[02] the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
• PM-22c.
  • PM-22c.[01] the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
  • PM-22c.[02] the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
• PM-22d.
  • PM-22d.[01] the policies address appeals of adverse decisions on correction or deletion requests;
  • PM-22d.[02] the procedures address appeals of adverse decisions on correction or deletion requests.

Examine: Privacy program plan; policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion; records of monitoring PII quality management practices; documentation of reviews and updates of policies and procedures.

Interview: Organizational personnel with privacy program information dissemination responsibilities; organizational personnel with privacy responsibilities.

Test: [Organizational processes for data quality and personally identifiable information quality management procedures; mechanisms supporting and/or implementing quality management requirements.

Policy statement

• The Senior privacy official shall develop and document organization-wide policies and procedures for reviewing personally identifiable information for accuracy, relevance, timeliness and completeness across the information life cycle. (PM-22a)
• The Senior privacy official shall develop and document organization-wide policies and procedures for correcting or deleting inaccurate or outdated personally identifiable information. (PM-22b)
• The Senior privacy official shall develop and document organization-wide policies and procedures for notifying individuals or other appropriate entities of corrected or deleted personally identifiable information. (PM-22c)
• The Senior privacy official shall develop and document organization-wide policies and procedures for appeals of adverse decisions on correction or deletion requests. (PM-22d)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-22 asks for organization-wide policies and procedures for the quality of personally identifiable information. They cover reviewing it for accuracy, relevance, timeliness and completeness across its life cycle (a), correcting or deleting inaccurate or outdated information (b), and telling individuals and other entities about corrections and deletions (c). They also cover appeals of adverse decisions on correction or deletion requests (d). PM-22 is in the SP 800-53B Privacy baseline.

NIST’s PM-22 discussion says to focus on business functions where inaccurate information may lead to adverse decisions, denial of benefits or services, or stigma. It also notes that correct information can sometimes cause problems that outweigh its value, and suggests procedures for removing it. The senior privacy official makes sure individuals have practical, accessible ways to seek correction or deletion, and the processes are clearly defined and public.

The discussion is specific about denials: the response gives the reasons, a way to record the individual’s objection, and a way to ask for review. Notice of a correction or deletion goes to the individual and, because data flows are complex, to other entities that hold the information. The system-level controls are SI-18 and SI-18(4); PM-22 sets the policy they carry out.

Common implementations. The Program Management policy gives PM-22 to the senior privacy official, as four clauses for (a) to (d). A typical procedure has these steps:

Step	What happens	Record
Review (a)	Each system owner checks the information at collection and on a schedule set in the system’s privacy impact assessment	Review results
Request	An individual asks for correction or deletion through the route the privacy notice gives	The request, logged with its date
Decide (b)	The data owner decides, with the privacy office, whether to correct, delete or deny	The decision and its reasons
Notify (c)	The individual is told the outcome; past recipients are told of the change, using the accounting of disclosures (PM-21)	Copies of the notices
Appeal (d)	A denied request can be reviewed by an official who did not make the first decision; the individual can add a statement of disagreement	The appeal and its outcome

The privacy notice section “Seeing and correcting your information” tells individuals how to ask. The privacy impact assessment section 8 records how each system checks quality and passes corrections to recipients.

Organization-defined parameters. PM-22 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who owns the policies and procedures	The senior privacy official (the clause), with each data owner carrying them out
How often information is reviewed (a)	At collection, and at least annually for information used to make decisions about individuals
Time to acknowledge and decide a request (b)	Acknowledge within 10 working days; decide promptly, within 30 days
Who hears appeals (d)	An official senior to, and independent of, the first decision maker

Evidence assessors ask for.

• The policies and procedures, covering each of (a) to (d)
• Records of quality reviews for a sample of systems (a)
• A sample of correction and deletion requests, with decisions, notices to the individual and to recipients (b, c)
• A sample of appeals and their outcomes, including denial letters that give reasons and the review route (d)

Inheritance. PM-22 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system carries out the procedures through SI-18 and SI-18(4).

Common findings.

• A correction process for the main system only, with copies elsewhere left uncorrected.
• Corrections made, but recipients of the old information never told (c).
• Denials sent without reasons or a way to appeal (d).
• No public description of how to ask for a correction.
• Quality checks at collection, with none later in the life cycle (a).

Enhancements. PM-22 has no enhancements.

Federal systems (as of October 2026). OMB Circular A-130, main body section 5.f(1)(e), requires agencies, to the extent reasonably practicable, to “ensure that PII is accurate, relevant, timely, and complete.” For records in a system of records, the Privacy Act requires that records used in a determination about an individual be accurate, relevant, timely and complete as reasonably necessary for fairness (5 U.S.C. § 552a(e)(5)). Before disseminating a record outside an agency, the agency makes reasonable efforts to assure the same qualities (e)(6).

Subsection (d)(2) has the agency acknowledge an amendment request in writing within 10 days (excluding weekends and legal public holidays). It then promptly corrects the record or explains the refusal and the review procedure. Under (d)(3), a review of a refusal is completed within 30 days, unless the agency head extends it for good cause, and the individual may file a statement of disagreement. Under (c)(4), the agency informs past recipients of corrections and notations of dispute.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy