Supplementary Statement

What a supplementary statement does

A supplementary statement is not a correction in itself. It is a formal notice that the person and the organisation disagree about the accuracy of a piece of personal data, so the record remains visible but its contested status is also preserved.

This matters because the underlying entry can continue to exist in operational systems, reports or case files while the disagreement is being addressed. The supplementary statement gives downstream readers context without overwriting the original data or forcing premature agreement.

How supplementary statements preserve record integrity

The main purpose of a supplementary statement is traceability. It allows an organisation to keep the original record intact, which is important where the data may have been used for decisions, compliance evidence or historical auditability.

That separation between the record and the dispute helps prevent silent data loss. If the original entry were simply replaced, later users could lose sight of what was actually reported, when it was challenged, and whether any decision was made on contested information.

When a supplementary statement is used

Supplementary statements are typically relevant when a person has exercised a right to contest personal data, but the organisation is not satisfied that the original record should be changed immediately. The note becomes part of the data context, not a substitute for verification or review.

In practice, this is most useful where accuracy is disputed but the organisation still needs to retain the record for legal, operational or evidential reasons. The statement signals that any later use of the data should take the disagreement into account.

Why supplementary statements matter for privacy governance

From a governance perspective, a supplementary statement is a control against false certainty. It prevents contested personal data from being treated as undisputed fact, especially when the information may influence profiling, eligibility checks, investigations or other decisions.

It also creates accountability. If the organisation continues to rely on disputed data, the existence of the statement shows that the disagreement was known and should have been considered rather than ignored.

Practitioner Guidance

Why practitioners should care: The value of a supplementary statement is not just that it records disagreement, but that it preserves downstream decision context. Teams handling records, case management or privacy operations should make sure the note is visible wherever the underlying data is reused.

Common misunderstanding: A supplementary statement does not prove the disputed data is wrong, and it does not automatically delete or replace the original entry. It is a contextual safeguard, not an adjudication.

Related resources from NHI Mgmt Group

• What do teams get wrong about the statement of applicability?
• How do you know if quantum preparedness is more than a policy statement?
• What is the difference between relying on a transfer framework and relying on updated standard contractual clauses with supplementary measures?
• How should security teams write an ISO 27001 Statement of Applicability so it stands up in audit and internal review?