Users can correct inaccurate personal data through the application UI

GDPR Art. 16 and Art. 5(1)(d) require that personal data be kept accurate and that data subjects can correct inaccurate information. A profile page that displays personal data as read-only — no edit form, no save button — removes the user's ability to exercise this right. This is a quiet but persistent violation: the user's name or contact details may be wrong, and they have no mechanism to fix it. Email address changes carry additional security weight: allowing an email swap without verification exposes accounts to takeover, which creates a compounding GDPR breach risk on top of the rectification failure.

Implement a profile edit form with a PATCH API call that persists changes immediately. Route email address changes through a separate verification flow.

// app/settings/profile/page.tsx
'use client'
export default function ProfileSettingsPage({ user }: { user: User }) {
  const [name, setName] = useState(user.name ?? '')
  async function handleSave(e: FormEvent) {
    e.preventDefault()
    const res = await fetch('/api/user/profile', {
      method: 'PATCH',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ name }),
    })
    if (res.ok) toast.success('Profile updated.')
  }
  return (
    <form onSubmit={handleSave}>
      <label>Display Name<input value={name} onChange={e => setName(e.target.value)} required /></label>
      <p className="text-sm">To change your email, <a href="/settings/change-email">start the email change process</a>. A verification link will be sent to the new address.</p>
      <button type="submit">Save changes</button>
    </form>
  )
}

For the email change flow: store the pending change in a pending_email_changes table with an expiry token, send the verification link to the new address, and only apply the swap after the token is clicked. Never update email in the users table without email verification.