Right to rectification
The right to rectification entitles data subjects to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
The right to rectification under Article 16 GDPR gives every data subject an enforceable claim to have the controller correct inaccurate personal data concerning them without undue delay. It directly supports the accuracy principle in Article 5(1)(d) GDPR, which requires personal data to be accurate and, where necessary, kept up to date. Inaccuracy is generally assessed against the objective facts; pure value judgements, opinions or forecasts are not in themselves subject to rectification, although the inaccurate facts underlying them are.
In addition to correcting incorrect data, Article 16, second sentence GDPR expressly covers the right to have incomplete data completed, including by means of a supplementary statement. Whether data are incomplete is judged by reference to the specific purpose of processing (purpose limitation): if information required for that purpose is missing, the data subject may request that it be added. The controller must comply without undue delay; the general one-month response deadline in Article 12(3) GDPR sets the outer limit. Where the data subject contests the accuracy of the data, they may additionally request restriction of processing under Article 18(1)(a) GDPR while the matter is being verified.
Under Article 19 GDPR the controller has a notification duty: any rectification must be communicated to each recipient to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. On request, the data subject must be informed about those recipients. Fulfilling the rectification request is in principle free of charge under Article 12(5) GDPR. If the controller refuses rectification, it must give reasons and inform the data subject of the right to lodge a complaint with the supervisory authority and to seek a judicial remedy. A reliable process for handling rectification requests is also an expression of the accountability principle in Article 5(2) GDPR.
Legal Basis
Art. 16 GDPR (in conjunction with Art. 5(1)(d), Art. 12 and Art. 19 GDPR)
Practical Example
A customer informs the data protection officer of a mail-order retailer that her surname has been stored incorrectly in her customer account since her marriage and that the delivery address is out of date. The data protection coordinator verifies the details against the identity document provided, corrects the name and address in the CRM without delay, and adds the previously missing floor number. He then informs the contracted logistics provider as a recipient of the rectification (Article 19 GDPR), records the handling and deadline in the access-and-rectification log, and confirms the correction to the customer in writing within the one-month period.