Use this guide to resolve Correction Rights under the CCPA as amended by the CPRA, including the trigger, required action, deadline, owner, and evidence.
Apply the cited California statute and regulations to the actual entity, data flow, system, and recipient role; escalate unresolved legal interpretation.
Structured answer sets in this page tree.
Cited legal and guidance references.
A California consumer may ask a covered business to correct inaccurate personal information that it maintains. Confirm receipt within 10 business days, verify the request under the regulations, decide accuracy from the , and respond within 45 calendar days unless a permitted extension applies. A correction must reach active systems and the service providers and contractors that maintain the information.
First identify the contested information and every system that maintains it. Confirm whether the request came from the consumer or an authorized agent, apply the required verification standard, and avoid collecting new identity information unless necessary. If identity cannot be verified, the business may deny the request but must tell the requester that verification failed.
Decide accuracy from the , including whether the information is objective or subjective, how the business obtained it, and documentation from the consumer, the business, or another source. The business may deny the request if the contested information is more likely than not accurate. If the business is not the source and has no supporting documentation, the consumer's assertion may be enough to establish inaccuracy.
The statute requires commercially reasonable efforts to correct inaccurate information. The regulations also allow a business to delete the contested information instead when deletion will not negatively affect the consumer or when the consumer consents. If deletion could make it harder to obtain employment, housing, credit, education, or another opportunity, correct the information or obtain consent before deleting it.
Correct the information in existing active systems and instruct each service provider or contractor that maintains it under the written contract to make the correction or enable the business to do so. Archived or backup copies may wait until the relevant system is restored, accessed, or used.
Tell the consumer whether the request was completed. If the consumer asks, disclose the specific pieces maintained and collected about them so they can confirm the correction; for Social Security numbers, government identifiers, financial or medical account numbers, passwords, security answers, and unique biometric data, provide a confirmation method without disclosing the sensitive value itself. The case file should show the old and corrected value where retaining that comparison is necessary and lawful, each affected system and recipient, the instruction date, completion status, and any backup-system dependency.
Privacy operations should own the case and timing. The data owner decides the authoritative value, engineering or operations changes systems, recipient owners transmit instructions, and privacy or legal reviews exceptions, material disputes, and denials.
A denial may rest on failed verification, a finding that the information is more likely than not accurate, a statutory exemption, inadequate required documentation, impossibility, or disproportionate effort. The response must explain the basis. A bare statement that correction is impossible or burdensome is not enough.
A business that denied the same alleged inaccuracy within the previous six months may deny a repeat request, but it must treat the request as new when the consumer provides new or additional documentation. If the business denies correction of personal information collected and analyzed concerning the consumer's health, it must explain that the consumer may request a written statement in the record. The statement is limited to 250 words for each alleged inaccuracy and, once received with the required request, must be included with the consumer's record.
Disproportionate effort is a request-specific test that compares the time and resources needed with the reasonably foreseeable effect on the consumer. A business cannot rely on its failure to build adequate request processes as the reason the effort is disproportionate.
Test with representative records that appear in a primary database, derived profile, analytics store, customer-support tool, service provider, and backup. Confirm that intake starts the deadline, verification is proportionate, evidence reaches the data owner, and the final response matches the recorded outcome.
The workflow should prevent corrected information from being overwritten by an unchanged source or reintroduced through a batch import. Record the authoritative source and any synchronization, model, or enrichment process that must change.
This US CPRA guide turns Correction Rights into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn Correction Rights into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"A consumer shall have the right to request a business that maintains inaccurate personal information about the consumer to correct that inaccurate personal information."
"A business may deny a consumer’s request to correct if it determines that the contested personal information is more likely than not accurate based on the totality of the circumstances."
"The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses."
"The NIST Privacy Framework (PF) is a voluntary tool developed in collaboration with stakeholders intended to help organizations identify and manage privacy risk to build innovative products and services while protecting individuals’ privacy."