US CPRA Correction Rights

First identify the contested information and every system that maintains it. Confirm whether the request came from the consumer or an authorized agent, apply the required verification standard, and avoid collecting new identity information unless necessary. If identity cannot be verified, the business may deny the request but must tell the requester that verification failed.

Decide accuracy from the totality of the circumstances, including whether the information is objective or subjective, how the business obtained it, and documentation from the consumer, the business, or another source. The business may deny the request if the contested information is more likely than not accurate. If the business is not the source and has no supporting documentation, the consumer's assertion may be enough to establish inaccuracy.

The statute requires commercially reasonable efforts to correct inaccurate information. The regulations also allow a business to delete the contested information instead when deletion will not negatively affect the consumer or when the consumer consents. If deletion could make it harder to obtain employment, housing, credit, education, or another opportunity, correct the information or obtain consent before deleting it.

Correct the information in existing active systems and instruct each service provider or contractor that maintains it under the written contract to make the correction or enable the business to do so. Archived or backup copies may wait until the relevant system is restored, accessed, or used.

Tell the consumer whether the request was completed. If the consumer asks, disclose the specific pieces maintained and collected about them so they can confirm the correction; for Social Security numbers, government identifiers, financial or medical account numbers, passwords, security answers, and unique biometric data, provide a confirmation method without disclosing the sensitive value itself. The case file should show the old and corrected value where retaining that comparison is necessary and lawful, each affected system and recipient, the instruction date, completion status, and any backup-system dependency.

Privacy operations should own the case and timing. The data owner decides the authoritative value, engineering or operations changes systems, recipient owners transmit instructions, and privacy or legal reviews exceptions, material disputes, and denials.

A denial may rest on failed verification, a finding that the information is more likely than not accurate, a statutory exemption, inadequate required documentation, impossibility, or disproportionate effort. The response must explain the basis. A bare statement that correction is impossible or burdensome is not enough.

A business that denied the same alleged inaccuracy within the previous six months may deny a repeat request, but it must treat the request as new when the consumer provides new or additional documentation. If the business denies correction of personal information collected and analyzed concerning the consumer's health, it must explain that the consumer may request a written statement in the record. The statement is limited to 250 words for each alleged inaccuracy and, once received with the required request, must be included with the consumer's record.

Disproportionate effort is a request-specific test that compares the time and resources needed with the reasonably foreseeable effect on the consumer. A business cannot rely on its failure to build adequate request processes as the reason the effort is disproportionate.

Test with representative records that appear in a primary database, derived profile, analytics store, customer-support tool, service provider, and backup. Confirm that intake starts the deadline, verification is proportionate, evidence reaches the data owner, and the final response matches the recorded outcome.

The workflow should prevent corrected information from being overwritten by an unchanged source or reintroduced through a batch import. Record the authoritative source and any synchronization, model, or enrichment process that must change.