Data Protection Act 2018
74. (1) A controller shall, where relevant and in so far as is possible, make a distinction between the personal data of different categories of data subject.
(2) A controller shall, in so far as is possible, ensure that personal data based on facts are distinguished from personal data based on personal assessments.
(3) A controller shall—
(a) take all reasonable steps to ensure that personal data that are inaccurate, incomplete or no longer up to date are not transmitted or otherwise made available,
(b) verify, in so far as is possible, the quality of personal data before they are transmitted or otherwise made available, and
(c) provide, in so far as is possible, in a transmission of personal data, the information necessary for the recipient to assess the accuracy, completeness and reliability of the data and the extent to which the data are up to date.
(4) Other than where section 92 applies, where a controller becomes aware that incorrect personal data have been transmitted or personal data have been unlawfully transmitted—
(a) the controller shall ensure that the recipient of the personal data is notified without delay of that fact, and
(b) the recipient shall ensure that the personal data are rectified or erased or the processing of the data is restricted, as may be appropriate.