When a person corrects their data, update the source of record, then push the correction to every copy and tell recipients who received the old value. GDPR Article 16 gives the right to correct inaccurate data and to complete incomplete data, and Article 19 expects notification to recipients.
What the right covers
Article 16 provides the right to obtain "the rectification of inaccurate personal data" without undue delay, and, depending on the purposes, to have incomplete data completed, including by means of a supplementary statement. So the right is not only about typos. A person may also add context where a record is misleading.
Design for one source of truth
Corrections are painful when a field is stored in six places with no owner. Pick a system of record for each data element and treat the others as derived copies. A name change goes to the identity service, and everything else refreshes from it.
Your data map should show, for each field, the owner and the copies.
Propagation patterns
- Event driven. The system of record publishes
profile.updated. Subscribers update their copy. Track acknowledgements as with consent withdrawal. - Read through. Downstream systems fetch the live value rather than storing one. Best where it is feasible.
- Batch refresh. For warehouses and reports, rebuild from the source on a schedule and state the delay.
Whatever you choose, test it: change a field in a test account and verify it in each store, including search indexes and caches.
Records you must not silently rewrite
Some records are meant to preserve history. An invoice issued to an old name, a signed contract or an audit log entry should not be altered. Instead of editing, add a correction entry or supplementary statement, and make the later system use the corrected value going forward. Decide with counsel which records are in this class.
Tell recipients
Article 19 requires the controller to communicate rectification to each recipient the data was disclosed to, unless that proves impossible or involves disproportionate effort. The person may also ask who the recipients are. Keep a recipient list per data category so you can answer both points.
Disputed accuracy
Sometimes you disagree that the data is wrong. Do not just refuse. Check the evidence, tell the person your decision and reasons within the Article 12 time limit, and mention that they can complain to a supervisory authority. Article 18 allows restriction of processing while accuracy is checked in some cases, so involve your privacy lead.
Self service helps
Most corrections are simple, like an address or a name. A profile page that lets people edit their own data handles them instantly and reduces tickets. Reserve the formal route for data users cannot edit, such as inferred or historical records.
Quick check
Do I have to tell third parties about a correction?
Yes where you disclosed the data to them, unless it is impossible or needs disproportionate effort, under Article 19.
Can I edit an issued invoice?
Usually you should not rewrite it. Add a correction document and check retention rules with counsel.
Sources
Last reviewed: 19 October 2026.
