How should a business handle a correction request under the US CPRA?
A consumer has the right to request that a business correct inaccurate personal information, and the business must use commercially reasonable efforts to correct that information as directed by the consumer. The business should review the request in light of the nature of the information and the purposes of processing, then route the request to the team that can update the record or explain why correction is not required.
Businesses should provide a clear request path, respond within 45 days, and notify the consumer if they need more time. They may deny a request if they cannot verify the consumer, if the information is more likely than not accurate based on the totality of the circumstances, or if the information is exempt from the CPRA. Service providers and contractors must assist the business in correcting inaccurate information when they process the information for the business.
- Confirm whether the consumer identified the record that is inaccurate and what correction they want.
- Check whether the request can be verified using commercially reasonable methods.
- Document the decision, the correction made, or the reason for denial so the response is auditable.
Verifies the CPRA correction-request handling rule in section 7023, including accuracy review, denial explanations, and service-provider correction instructions.
Direct support for the FAQ answer on Correction Rights.
Direct statutory source for the California consumer right to request correction of inaccurate personal information.