An incorrect piece of data may look like a minor issue until it has consequences: a bill sent to your old address, a parcel that never arrives, an application blocked because your tax code contains an error, an insurer calculating your premium on outdated information. The GDPR treats accuracy as a core principle and gives you a direct tool to enforce it: the right to rectification.
What the rule says
Article 16 of Regulation (EU) 2016/679 provides two entitlements:
- to obtain the rectification of inaccurate personal data concerning you, without undue delay;
- to have incomplete data completed, including by providing a supplementary statement, taking into account the purposes of the processing.
This right is the flip side of an obligation on the controller. Article 5 GDPR states that data must be "accurate and, where necessary, kept up to date" and that every reasonable step must be taken to erase or rectify without delay data that is inaccurate in relation to its purposes.
Accurate compared with what
Accuracy must be read in light of the purpose for which the data is processed. A few examples help.
- A changed home address is inaccurate for a supplier that needs to send you documents: you are entitled to have it replaced.
- An order history showing an old address is not inaccurate, because it records something that actually happened: here the point is not to correct it but, if anything, to add the new address for future deliveries.
- A misspelt name, or one missing a middle name that identifies you in official documents, is an error that should be corrected, especially if it causes identification problems.
- An incomplete record, for instance a debt marked as outstanding when it has been paid, can be completed with the missing information.
Rectification concerns factual data. Assessments and opinions, such as a recruiter's view of an interview, cannot be "corrected" on the merits: you can, however, ask for the facts they rely on to be corrected or for your own statement to be added.
How to make the request
The procedure is simple and follows the general rules of Article 12 GDPR.
- Identify the controller. The privacy notice gives the contact details of the controller and, if there is one, of the Data Protection Officer.
- State the wrong data and the correct data. The more precise you are, the faster the fix: "in my customer profile no. 12345 my date of birth appears as 03/07 instead of 07/03".
- Attach evidence if needed. For verifiable data, such as a change of address or a name, a single document may be enough. Send only what is necessary, not your entire personal file.
- Ask for confirmation of the change. The controller must inform you of the outcome.
The deadline to reply is one month, extendable by two months in complex cases with a reasoned notice. The rule, however, speaks of rectification "without undue delay": for a trivial error, a month's wait is hard to justify.
While the data is being checked
If the company needs time to verify whether the disputed data is really inaccurate, you can request restriction of processing under Article 18. In practice the data stays stored but is not used, for example for decisions about you, until the check is complete.
The duty to inform others
A little-known provision is Article 19 GDPR. When the controller rectifies data, it must communicate the correction to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort. If you ask, it must also tell you who those recipients are.
This matters because an error rarely stays in a single database. A wrong email address entered by an operator may be passed to the courier, the outsourced help desk and the billing platform. Invoking Article 19 saves you from chasing the error company by company.
When rectification is not enough
| Problem | Most suitable right |
|---|---|
| The data is wrong | Rectification (Art. 16) |
| The data is incomplete | Completion (Art. 16) |
| The data is accurate but should not be processed | Erasure (Art. 17) or objection (Art. 21) |
| Accuracy is disputed and time is needed | Restriction (Art. 18) |
| You do not know what data exists | Access (Art. 15) |
It often pays to combine rights: first an access request to see what is there, then a targeted rectification of the errors.
If the request is ignored
If the controller does not reply or refuses without a plausible reason, you can send a reminder citing Articles 12 and 16 and then lodge a complaint with the data protection authority under Article 77. If inaccurate data has caused you concrete harm, for example a rejected application, Article 82 GDPR recognises the right to compensation for material or non-material damage.
In short
- Article 16 GDPR lets you have inaccurate data corrected and incomplete data completed, without undue delay.
- Accuracy is judged against the purpose: a correct history is not rewritten, an outdated address is.
- While accuracy is being checked you can request restriction of processing.
- Article 19 requires the controller to pass the correction on to the data's recipients.
- If the controller does nothing, you can turn to the supervisory authority and, if you suffered damage, seek compensation.