Right to rectification

What it means

The right to rectification is a data subject's right under the GDPR to have the controller correct inaccurate personal data about them without undue delay and complete incomplete data. It follows from the accuracy principle, under which data must be correct and kept up to date where necessary.

Typical cases are a change of surname, address or phone number, a wrongly recorded date of birth or an error in a bank account number. Incomplete data can also be completed by means of a supplementary statement where the record cannot otherwise be changed, for instance a historical entry.

The right is closely linked to the right of access: a person first finds out what data the company holds and then asks for corrections. While accuracy is being checked, they can also request restriction of processing so the disputed data are not used.

How it works in practice

A request can arrive in any form, including by email or phone. The controller should verify the requester's identity and, where needed, the accuracy of the new data, for example with proof of a name change. The deadline is normally one month.

The correction must be carried through every system holding the data: CRM, invoicing and accounting software, payroll and marketing tools. If the controller disclosed the data to other recipients, it informs them of the correction unless that is impossible.

Accounting documents follow special rules: an issued invoice cannot simply be rewritten, and corrections are made with a corrective document under accounting and tax law. Archived documents stay in their original form, but new documents must carry the correct data.

What to watch out for

Uncorrected errors can cause real harm, such as a loan refused because of a wrong record or post sent to an old address. Besides a complaint to the authority, a claim for damages may follow.

The controller does not have to change data that are correct just because the person dislikes them, such as a record of an unpaid invoice. A refusal must, however, be explained, and the person told they can complain to the supervisory authority.