Right to Correct

The right to correction (also called 'rectification') is set out in GDPR Article 16, DPDP Act section 12 with Rule 6, and PDPA sections 22–22A. The data subject must be able to request correction of inaccurate data or completion of incomplete data, and the controller must act without undue delay. Where correction is refused — because the controller believes the data is accurate — the refusal must be reasoned and communicated to the subject, who typically retains a right to appeal to the regulator.

The operational complexity is downstream propagation. GDPR Article 19 obliges the controller to communicate the correction to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort. For a Data Fiduciary that has shared customer data with a dozen processors and sub-processors (CDPs, email providers, analytics platforms, HRMS, finance systems), the correction right is only as good as the propagation workflow that pushes updates to each. Automated DSR tooling that writes the correction back through the integration layer is what distinguishes a mature programme from a reactive one.