Right to Correction
A Data Principal’s right to have inaccurate or misleading data corrected, incomplete data completed and outdated data updated.
This is your right to have wrong, incomplete or out-of-date personal data fixed by an organisation that holds it.
Meaning of Right to Correction
The Data Fiduciary must correct and complete the data, and update it where needed. The person must give verifiable, authentic information when asking.
Section 12(1) of the DPDP Act gives a Data Principal the right to correction, completion, updating and erasure of her personal data for the processing of which she has previously given consent, including consent treated as given under Section 7(a). Section 12(2) spells out what the fiduciary must do on receiving a correction, completion or updating request: correct inaccurate or misleading data, complete incomplete data, and update the data.
These are three different jobs. Correction fixes something that is wrong, such as a misspelt name or wrong date of birth. Completion fills a gap, such as a missing middle name or a landline number. Updating refreshes data that was right once but has changed, such as a new address or a changed marital status. A request process that only handles typos will not satisfy the Act.
The Act also puts a duty on the individual. Section 15(e) says that when exercising the right to correction or erasure, she must furnish only information that is verifiably authentic. A fiduciary can therefore ask for reasonable proof, such as a marriage certificate to change a surname. The mechanics are set by Rule 14, which requires the fiduciary to publish how requests are made and respond within a period of no more than ninety days.
The right sits beside the fiduciary's own duty in Section 8(3) to ensure completeness, accuracy and consistency of data where it is likely to be used to make a decision about the Data Principal or disclosed to another fiduciary. It differs from the right of access in Section 11, which only tells you what is held, and from erasure, which removes data rather than fixing it. After a fix, the change should flow to processors and any recipients where it matters.
Examples of Right to Correction
A customer notices her surname is misspelled on her invoice, asks for a fix and gets the account and billing record updated.
A patient finds her blood group was recorded wrongly. She asks for correction with a lab report as proof. The hospital updates the record, flags it to the pharmacy and lab systems, and confirms to her in writing.
A customer's invoice shows a misspelt name. She submits a request through the account page, the store changes the account and billing record, and issues a fresh invoice.
A policyholder moves house and asks to update her address. The insurer updates its policy system and its claims processor's copy so renewal notices and claim letters reach her correctly.
Why Right to Correction matters
Wrong data causes real harm: a loan rejected because of a mismatched surname, a missed insurance claim, a courier sent to an old address, a certificate printed with an error. People often cannot spot such mistakes until something goes wrong, so a simple route for fixing them protects both the individual and the organisation's own business decisions.
For the fiduciary, ignoring or delaying correction requests invites complaints to the Board and a penalty under the residual head of up to ₹50 crore. Inaccurate data left uncorrected may also undermine compliance with the accuracy duty in Section 8(3), which is a ground for scrutiny after an incident.
How it works in practice
- 1Provide an easy self-service option in the account settings for simple fields such as address and phone, and a form or email route for items that need checking.
- 2Define which documents you accept as proof for sensitive fields such as name or date of birth, apply the same standard to everyone, and publish the list.
- 3Make the change at the source and in every downstream system, including backups where feasible at the next refresh, reports and data held by processors.
- 4Tell the person when the change is done, and notify recipients you shared the old data with where the error could affect them.
- 5Keep a record of the old value, the new value, the reason and the date where law or audit needs it, but do not keep the wrong value live in systems that make decisions.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Fixing the front-end profile but leaving old values in billing, CRM or processors' systems, so the error keeps returning.
Refusing any request that has no document. Many changes are low-risk and can be accepted on reasonable checks.
Treating correction as only about errors. The Act also covers completion and updating.
Compliance tips
Keep a list of systems that hold each field so a correction can be pushed everywhere in one workflow.
Use risk-based proof rules: light checks for address, firmer checks for identity fields.
Review correction requests every quarter; frequent errors in one field point to a weak form or data feed.
Common questions about Right to Correction
Does the DPDP Act give me the right to correct my data?
Yes. Section 12 gives a Data Principal the right to correction, completion and updating of personal data she has consented to be processed, and Section 12(2) requires the fiduciary to act on a valid request.
Can a company ask for proof before correcting my data?
Yes, within reason. Section 15(e) expects the individual to supply only verifiably authentic information when exercising this right, so a fiduciary may ask for suitable evidence, especially for identity-related fields. The proof demanded should be proportionate.
What if the company ignores my correction request?
Complain first through the fiduciary's grievance channel under Section 13. If that does not resolve it, you may then approach the [Data Protection Board](term/data-protection-board-of-india), since the Act requires you to exhaust the grievance route before the Board.