Presumably you need to prove who you are to make changes to your record however. GDPR doesn’t give me the right or require a company to change a phone number if I call them up and tell them to change the number for some random name without proof of identity.