SOC 2 P5.2: Privacy - Correction of Personal Information

Set up a correction request process. Define how people can request changes (self-service portal, email, support ticket), what information you need to process the request, how you verify the correction is accurate, and how quickly you will complete it. For simple changes like contact details, let users update their own profiles directly. Build correction propagation into your systems. When personal data is corrected in one place, the change needs to reach every system holding that data. Map your downstream systems, integrated partners, and third-party recipients. Automate propagation where possible - manual processes break down as you scale. Notify third parties when you shared incorrect data with them. If a vendor, partner, or service provider received the wrong information, tell them about the correction and ask them to update their records. Keep a record of these notifications and any confirmations you receive back. Plan for disputes. Sometimes you will believe your data is accurate and the individual disagrees. Provide an explanation and an opportunity to appeal. If you cannot resolve the disagreement, append the individual's statement of disagreement to their record. Document how the dispute was handled. Maintain an audit trail. Record every correction request, the original and corrected values, when the change was made, who made it, and which systems and third parties were updated. This supports both audit requirements and any future questions about data accuracy. Enable self-service correction for common data elements. Let authenticated users update their profile, contact details, and preferences without filing a formal request. Add validation rules to ensure the changes produce valid data, and log everything through your audit system.