(1) The controller must, if so requested by a data subject, rectify without undue delay inaccurate personal data relating to the data subject.
(2) Where personal data is inaccurate because it is incomplete, the controller must, if so requested by a data subject, complete it.
(3) The duty under subsection (2) may, in appropriate cases, be fulfilled by the provision of a supplementary statement.
(4) Where the controller would be required to rectify personal data under this section but the personal data must be maintained for the purposes of evidence, the controller must (instead of rectifying the personal data) restrict its processing.