In one sentence. GDPR Article 16 grants the data subject the right to obtain rectification of inaccurate personal data concerning them and to have incomplete personal data completed, including by providing a supplementary statement. The controller must respond within one month (extendable by two months for complex requests). Article 19 separately requires the controller to communicate the rectification to each recipient to whom the data was disclosed.
A data subject may exercise Article 16 after an access request (Article 15) reveals an error. The right is procedurally simple but operationally non-trivial: rectification must propagate to all downstream systems and recipients, not just the primary record.
For related rights: right of access (Article 15), right to erasure (Article 17), restriction of processing (Article 18). For procedural modalities: Article 12 transparency.
Key takeaways
- Right to correct inaccurate data + complete incomplete data.
- Deadline: one month (extendable to three months for complex requests).
- Article 19 requires notification to each recipient to whom the data was disclosed.
- The right is broader than it appears: covers inaccurate facts, outdated information, missing context — the corrective arm of the Article 5(1)(d) accuracy principle.
- For data the controller cannot independently verify (e.g., subjective evaluations), supplementary statement allowed.
1. Article 16 text
“The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”
Two distinct rights in one Article:
- Rectification of inaccurate data
- Completion of incomplete data (potentially via supplementary statement)
2. When is the right exercised?
Common triggers:
- Address change not propagated
- Misspelled name
- Outdated contact information
- Incorrect demographic data
- Inaccurate transaction history
- Outdated employment status
- Wrong medical record entry
- Incorrect calculation (credit score, premium)
The data subject must typically identify the specific inaccuracy. Generic “correct everything wrong” requests are unusual but not unlawful.
3. Verification of the inaccuracy
The controller may verify that the request is genuine:
- Comparison with original source documents
- Confirmation from the data subject themselves
- Cross-reference with authoritative sources (civil register for name changes, etc.)
For subjective data (evaluations, ratings, opinions), Article 16 has limits — the controller cannot be forced to “correct” a subjective evaluation simply because the data subject disagrees. Check whether the opinion is accurately recorded, attributed and based on correct facts. Completion by a supplementary statement is relevant where the data is incomplete taking account of the processing purposes; disagreement alone does not make every opinion inaccurate.
4. Deadline (Article 12(3))
Respond without undue delay and within one month of receipt. Article 12(3) permits up to two further months where necessary taking account of complexity and the number of requests; notify the person within the first month and explain the reasons.
Do not treat the month as a waiting period. Record the actual reason for an extension; a medical or credit-history request does not automatically qualify merely because of its subject matter.
5. The Article 19 notification cascade
Article 19 GDPR requires the controller to communicate any rectification (or erasure or restriction) to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort.
This cascade matters:
- Correction in the CRM but not in the email marketing tool → marketing emails go to outdated address
- Correction in HR system but not in payroll → wage paid to wrong account
- Correction in master record but not in analytics platform → reports show inaccurate data
The fix: implement a propagation procedure that updates downstream systems when the master record is rectified.
6. Data subject right to know about recipients
Article 19 also gives the data subject the right to be informed about the recipients to whom rectification was communicated, if they ask. This means the controller must keep a record of where data was disclosed.
7. Distinction from right to complete
The “right to complete” (second clause of Article 16) covers cases where data is technically accurate but missing context. Example:
- Record states “patient has cancer” — accurate, but missing “in remission since 2020”
- Record states “candidate has 2 years of experience” — accurate, but missing “plus 5 years prior in adjacent field”
The data subject can request that the controller add the missing context, potentially via a supplementary statement that doesn’t replace but augments the original data.
8. Common implementation failures
| Failure | Risk |
|---|---|
| Correction in primary record only, no downstream propagation | Article 19 violation, ongoing inaccuracy |
| No procedure for handling rectification requests | Missed deadline |
| Refusal to assess whether an accurate record is incomplete for its purpose | Failure to address the completion request |
| Identity verification disproportionate (requiring ID for typo correction) | Article 12 violation |
| No reliable way to identify relevant recipients | Difficulty meeting Article 19; the Article 30 record, which may list categories, is not a complete disclosure log |
9. Sanctions
Article 16 violations are typically sanctioned under Article 83(5)(b) — up to €20M or 4% of global turnover.
The actual penalty depends on the infringement and the Article 83 circumstances. A fine for retention, information or security is not evidence of an Article 16 breach; check the decision before using it as a rectification example.
10. Practical workflow
- Reception — log timestamp, classify as Article 16
- Identity verification — proportionate
- Specify the inaccuracy — request additional details if needed
- Verify — check against source documents
- Rectify in master record
- Update affected systems and document any accuracy-verification restriction under Article 18(1)(a)
- Notify the data subject without undue delay and within one month, subject to a properly notified lawful extension
- Notify recipients under Article 19, unless impossible or disproportionate; document any exception
- Document the rectification in the request register
11. Sample response template
Subject: Rectification of your personal data — confirmation
Dear [Name],
Following your request dated [date], we have rectified your personal
data as follows:
Original (inaccurate):
[old value]
Corrected:
[new value]
The correction has been applied in the following verified systems:
- [System and completion date]
- [Any remaining action and accurate explanation]
The correction was also communicated to the following recipients
(Article 19 GDPR):
- [Recipient A, e.g., shipping provider]
- [Recipient B, e.g., payment processor]
You also have the right to:
- Request additional rectifications if needed
- Lodge a complaint with the supervisory authority (CNIL, etc.)
For questions: dpo@company.com
12. Tooling
For related guides: right of access GDPR, right to erasure GDPR, Article 12 transparency, GDPR Article 18 restriction.
Official sources: Article 16 (right to rectification) of Regulation (EU) 2016/679 on EUR-Lex, the EDPB guidelines, recommendations and best practices register, and the ICO guidance.
Conclusion
Article 16 is procedurally simple but operationally tests the architecture. A rectification that doesn’t propagate is a half-rectification — and Article 19 makes that the controller’s problem. Build the propagation pipeline before the first request arrives.
FAQ
How long do I have to respond to a rectification request?
One month from receipt, extendable by two months for complex requests. The data subject must be informed of any extension within the initial month.
Can I refuse to correct subjective data?
Disagreement alone does not require changing an accurately recorded opinion. Assess inaccurate facts, attribution and whether the record is incomplete for its purpose; completion may include a supplementary statement. Explain any refusal and the available complaint and judicial remedies.
Do I need to verify the data subject’s identity?
Yes, where reasonable doubt exists (Article 12(6)). But verification must be proportionate. Do not routinely require a passport copy for a typo correction when an existing authenticated account provides sufficient assurance.
What if I disclosed the data to third parties?
Article 19 requires notifying each recipient of the rectification unless impossible or disproportionate. The data subject also has the right to be informed about recipients on request.
What’s the difference between correction and completion?
Correction (first clause of Article 16) addresses inaccurate data. Completion (second clause) addresses technically accurate but missing context — typically via supplementary statement.