Right to Rectification

Legal Framework

Article 16 GDPR establishes the right to rectification, granting data subjects the ability to obtain from the controller, without undue delay, the correction of inaccurate personal data concerning them. The provision extends beyond mere correction: data subjects may also demand completion of incomplete personal data, including through supplementary statements, provided this aligns with the purposes of the processing. The dual structure—rectification of inaccuracy and completion of incompleteness—reflects a broader principle of data quality enshrined in Article 5(1)(d) GDPR, which requires that personal data be accurate and kept up to date.

Article 19 GDPR imposes a corresponding obligation on controllers: once rectification is carried out, the controller must notify every recipient to whom the personal data were disclosed, unless this proves impossible or involves disproportionate effort. Upon request, the controller must also inform the data subject about those recipients. This notification duty ensures that rectification has practical effect across the data ecosystem rather than remaining confined to the controller's own records.

Key Developments

The Court of Justice of the European Union has clarified the relationship between the right of access and rectification in Minister voor Immigratie v. M (Case C-393/12, 17 July 2014). The Court held that the right of access functions as a prerequisite for exercising rectification, erasure, or blocking of personal data. Access need not take the form of a full copy of records; a comprehensive summary in an intelligible form suffices, provided it enables the data subject to verify accuracy and assess compliance. This establishes a practical threshold: controllers cannot demand that data subjects pinpoint specific inaccuracies before providing access, as meaningful rectification depends on prior visibility of the data held.

In Bara and Others (Case C-201/14, 1 October 2015), the CJEU addressed the interplay between information obligations and data subject rights in the context of data transfers to third parties. While the case primarily concerned Articles 10 and 11 of Directive 95/46, its reasoning underscores that controllers cannot rely on generic legal provisions as substitutes for specific prior information about data recipients. This has direct implications for Article 19's notification requirement: controllers must maintain sufficient records of recipients to fulfill their downstream notification obligations after rectification.

The Dutch implementation designates the Autoriteit Persoonsgegevens as the sole supervisory authority responsible for GDPR enforcement, as permitted under Article 51 GDPR. This centralized enforcement model means that rectification complaints in the Netherlands flow through a single regulator.

Practical Guidance

• Establish a rectification workflow triggered by both direct requests and internal discovery of inaccuracies. Article 16 requires action "without undue delay"—implement internal service levels that ensure prompt verification and correction, not merely acknowledgment of the request.

• Maintain a recipient log for all personal data disclosures. Article 19's notification obligation is only dischargeable if the controller can identify recipients. Where data has been shared with multiple processors or third parties, ensure your records are granular enough to support targeted notifications.

• Do not gate rectification requests on prior formal access requests. Under Minister v. M, access and rectification are linked rights. If a data subject identifies an inaccuracy through any channel, treat the communication as a rectification request rather than redirecting them to a separate access procedure.

• Define "inaccurate" and "incomplete" with reference to processing purposes. Article 16's completion right is conditioned on the purposes of processing. Document your assessment of whether supplementary statements are necessary and proportionate to those purposes before accepting or rejecting completion requests.

• Assess disproportionality before skipping recipient notifications. Article 19 allows an exception where notification is impossible or involves disproportionate effort, but this must be documented on a case-by-case basis rather than applied as a blanket policy.