Article 16 GDPR : Rectification of Inaccurate Data and Completion of Incomplete Data

Scope of the Right to Rectification (Art. 16) and Recipient Notification (Art. 19)

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall also have the right to have incomplete personal data completed, including by means of providing a supplementary statement (Art. 16 GDPR).

The right to rectification covers two distinct dimensions: correcting factually inaccurate data (such as an address, amount, or date), and completing data that are incomplete relative to the processing purpose. It does not permit disputing subjective evaluations or opinions: a disagreement over an evaluation is addressed by attaching the supplementary statement to the contested data.

• Rectification without undue delay: the controller acts without undue delay, within the standard one-month statutory deadline set out in Article 12(3);
• Mandatory notification (Art. 19): any recipient to whom the rectified data were disclosed must be informed, unless this proves impossible or involves disproportionate effort;
• Synergy with Article 5(1)(d): accuracy is a cardinal data quality principle; rectification is the corresponding actionable remedy for the data subject;
• Free of charge: exercising the right is in principle free of charge (Art. 12(5)).

In practice, the controller documents the request, verifies the alleged inaccuracy against source documentation, corrects or completes the records, identifies recipients (facilitated by the Article 30 records), and issues notifications. Where a request is refused, the controller must provide reasoned justification and inform the individual of their right to lodge a complaint with the supervisory authority.

Verified Official Sources

See Also in the Legal Framework