Personal Data (Privacy) Ordinance Part 5—Division 2 5-24 Section 23 Cap. 486 practicable steps to advise the third party that the data is the subject of a data correction request still under consideration by the user (or words to the like effect). (Amended 18 of 2012 s. 15; 17 of 2018 s. 128) (4) A person who, in a data correction request, supplies any information which is false or misleading in a material particular for the purpose of having the personal data corrected as indicated in the request, commits an offence and is liable on conviction to a fine at level 3 and to imprisonment for 6 months. (Added 18 of 2012 s. 15) 23. Compliance with data correction request (1) Subject to subsection (2) and section 24, a data user who is satisfied that personal data to which a data correction request relates is inaccurate shall, not later than 40 days after receiving the request—  (Amended 18 of 2012 s. 2) (a) make the necessary correction to the data; (b) supply the requestor with a copy of the data as so corrected; and (c) subject to subsection (3), if— (i) the data has been disclosed to a third party during the 12 months immediately preceding the day on which the correction is made; and (ii) the data user has no reason to believe that the third party has ceased using the data for the purpose (including any directly related purpose) for which the data was disclosed to the third party, take all practicable steps to supply the third party with a copy of the data as so corrected accompanied by a notice in writing stating the reasons for the correction. Verified Copy Last updated date 20.4.2018