Right to Correct Personal Data - How to Handle a Correction Request Under US State Laws

The right to correct personal data lets a consumer require a business to fix inaccurate information it holds about them. Nineteen of the twenty comprehensive US state privacy laws now grant it, with Utah joining on July 1, 2026 and Iowa the only holdout. Under GDPR the same right is called rectification. In the US you generally have 45 days to respond, extendable once by another 45 with notice. The hard part is not the deadline. It is that one wrong value usually lives in six or eight systems, and a correction only counts when it reaches all of them.

What is the right to correct personal data?

It is a consumer's right to have inaccurate personal data about them corrected, taking into account the nature of the data and the purposes for which it is processed. That qualifier matters: the laws do not require you to accept every asserted correction. They require you to consider it, decide reasonably, and either make the fix or explain why you did not.

The wording differs slightly between statutes but the substance is consistent. California's CPRA gives consumers a right to correct inaccurate personal information and requires businesses to use commercially reasonable efforts. The Virginia-template states, which is most of them, give a right to correct inaccuracies in the consumer's personal data, taking into account the nature of the data and the purposes of processing. GDPR Article 16 gives a right to rectification without undue delay, plus a right to have incomplete data completed by means of a supplementary statement.

Which states have a right to correct?

Utah's addition is the reason this matters right now. Utah is the newest correction obligation in the country, and it landed on companies that had built their request workflow around access and deletion only. The Utah Consumer Privacy Act compliance page covers the thresholds and the 30-day cure period that still applies there, and the wider July 2026 changes put it alongside Connecticut's threshold cut and New Jersey's cure sunset.

Is the right to correct the same as the right to rectification?

Close, with two real differences. GDPR rectification includes an explicit right to have incomplete personal data completed, including by adding a supplementary statement, and it carries a downstream notification duty under Article 19: you must tell each recipient the data was disclosed to about the rectification, unless that proves impossible or involves disproportionate effort, and tell the person who those recipients were if they ask.

Most US state laws do not carry that Article 19 style notification duty in the same explicit form, and they do not have the completion right. What they do carry is the reasonableness qualifier, which gives you more room to decline a correction you have grounds to doubt, provided you explain the decision and, in states like Colorado, Connecticut, New Jersey, and Delaware, offer an appeal.

How the GDPR right to rectification works if you also have EU customers

If a European customer asks you to fix their data, Article 16 of the GDPR applies and the clock is one month, extendable by two more for complex requests only if you say so inside the first month. Three points catch US teams out.

Fact versus opinion. Data is inaccurate when it is incorrect or misleading as to a matter of fact. A wrong date of birth is either right or wrong. A support agent's note that a caller "was abusive" is an opinion, and it is not inaccurate merely because the person disagrees. The usual remedy for a contested opinion is not deletion. It is a supplementary statement recording the dispute, which is exactly what the completion half of Article 16 provides for.

Refusing is allowed, refusing silently is not. You can decline where the data is accurate or the request is manifestly unfounded or excessive, but you must tell the person within the month, say why, and tell them they can complain to a supervisory authority. If you cannot verify the disputed value either way, restricting processing of that field under Article 18 while you check is a better answer than a refusal you cannot support.

Downstream copies. Article 19 requires you to tell every recipient the data was disclosed to about the correction, unless that is impossible or involves disproportionate effort. "Disproportionate" means the recipients are genuinely untraceable, not that tracing them is tedious. The address you fixed in the CRM was synced to billing, exported to a marketing platform and sent to a shipping partner, and knowing how a record flows downstream through your systems turns that duty from a guess into a list.

How to respond to a correction request, step by step

1. Log the request and start the clock on receipt

The 45 days run from receipt, not from the day you decide the request is valid, and not from the day identity verification finishes. Time spent verifying counts against you. Record the date, the channel it arrived on, and the exact wording of what the person claims is wrong.

2. Verify the requester before you change anything

Correction carries a risk access does not. An attacker who succeeds at an access request learns something. An attacker who succeeds at a correction request changes your record of who someone is: a mailing address, a phone number for password resets, a bank detail. Verify to a standard that matches the sensitivity of the field being changed, and be stricter for anything that could be used to take over an account.

3. Find every copy of the value, not the first one

This is where correction requests go wrong. A single attribute like a home address will typically sit in your production database, a warehouse or BI copy, a CRM record, a support ticketing tool, an email or SMS platform, a billing system, and at least one vendor that received an export. Fixing the source of truth and calling it done leaves the person's data inaccurate everywhere else, and the next export re-propagates the old value. If you already run a platform that connects your apps, APIs, and databases, that integration surface is exactly the inventory you need to work through, because every connector is a place the wrong value may have landed.

4. Decide, and write the reason down

You are allowed to decline. If a consumer asserts a correction you have documented, authoritative evidence against, say a legal name that conflicts with an identity document you verified, you can refuse, taking into account the nature of the data and the purposes of processing. What you cannot do is refuse silently. Record the reason, tell the consumer, and give them the appeal route if the applicable state requires one.

5. Push the correction downstream and record it

Where the law or good practice requires it, notify the recipients you disclosed the data to. Under GDPR that is an explicit Article 19 duty. In the US it is generally good practice and, in California, the regulations expect commercially reasonable efforts including instructing service providers and contractors to make the correction. Keep a dated record of what changed, in which systems, and when, because that record is the only thing that proves the correction actually happened.

Frequently asked questions

How long do I have to respond to a data correction request?

Forty-five calendar days from receipt in almost every comprehensive US state privacy law, with one extension of up to 45 more days when reasonably necessary, provided you tell the consumer about the extension and the reason within the original window. Florida allows only a 15-day extension, and Iowa does not grant a correction right at all, so a correction request from an Iowa resident is not an ICDPA obligation in the first place. Under GDPR the deadline is one month from receipt, extendable by a further two months for complex or numerous requests, again with notice inside the first month.

Can I refuse to correct personal data?

Yes, in defined circumstances. US state laws let you weigh the nature of the personal data and the purposes of processing, so a correction you have credible, documented grounds to doubt can be declined. Under GDPR you may also restrict processing while accuracy is contested rather than making the change. In both cases you must tell the person you refused, explain why, and provide an appeal or complaint route where the applicable law requires one.

Does the CCPA include a right to correct?

Yes. The CPRA amendments added it effective January 1, 2023. A California consumer can request correction of inaccurate personal information, and the business must use commercially reasonable efforts to correct it, including instructing service providers and contractors that hold the data. You have 45 days to respond, extendable once by another 45 days with notice, and the request must be verified before you act.

What is the difference between correcting data and deleting it?

Correction fixes an inaccurate value and keeps the record. Deletion removes the record, subject to statutory exceptions such as completing a transaction, security, or complying with a legal obligation. Consumers sometimes ask for deletion when correction is what they actually want, and the reverse. Read the request for what it asks in substance rather than the label, and if it is genuinely ambiguous, ask before you act, because deletion cannot be undone.

Do I have to tell third parties about a correction?

Under GDPR, yes, unless it proves impossible or would involve disproportionate effort, and you must name the recipients if the person asks. In the US the duty is less explicit but California expects commercially reasonable efforts that include directing service providers and contractors. Practically, if you exported the wrong value to a vendor, you should assume you need to fix it there too, or the next sync will overwrite your correction.

Where this fits in the broader rights picture

Correction is one of a set. Under GDPR there are eight data subject rights, and under CCPA six consumer rights, and the operational spine underneath all of them is the same: verify the person, find where their data actually lives, decide what applies, act, and document it. The data subject rights pillar maps the full set, and the deadline table by state covers the clocks.

Obtainer handles the operational half of a correction request: it intakes the request, discovers where the person's data lives across your systems so you can see every copy of the value in question, compiles one reviewable manifest with source badges, drafts the response, and tracks the 45-day clock. Nothing is changed automatically. A person reviews and approves before anything moves. Obtainer helps you comply. It is not legal advice, so the decision to accept or refuse a correction stays with your team. Self-serve from $34/mo.