; (B) include a disclosure of— (i) what user information is stored by a particular system; (ii) whether that information is encrypted; and (iii) for how long the information is stored; and (C) provide for the Institute to provide, in a timely fashion, all data held related to an individual or entity upon the request of the individual or entity. (4) Data deletion Systems developed under the framework shall, to the greatest extent practicable, include a mechanism by which— (A) a user may request that any system operating under the framework delete any data on the user; and (B) such a request is honored within 72 hours, except as required by other applicable law. (5) Data correction Systems developed under the framework shall, to the greatest extent practicable, incorporate mechanisms under which— (A) a user may request to correct inaccurate data in the framework related to the user; and (B) such a request is honored within 72 hours after the correct data has been verified. (6) Other privacy practices The Institute may develop and enforce such other privacy practices as the Institute considers appropriate. (e) Cyber security The e-governance framework developed under subsection (a) shall incorporate cyber security best practices, including the following: (1) Appropriate access controls and user authentication, which may— (A) vary by service according to the sensitivity of the data involved