Right to rectification
lets data subjects have inaccurate personal data corrected and incomplete data completed. Its scope is largely unchanged from the Directive. Requests can be verbal or in writing with no formal requirements, and the controller must react within one calendar month. The right links to the accuracy principle (Article 5(1)(d)). Opinions are subjective, so flagging that a record is an opinion is good practice. If the request is honoured and data were shared with third parties, the controller must notify them.
Data subjects can require inaccurate data be corrected and incomplete data completed. The GDPR gives no definition of 'accuracy'; some national laws treated data as inaccurate if 'incorrect or misleading as to any matter of fact'. Because opinions are inherently subjective, best practice is to mark a record as an opinion rather than claim it is provably inaccurate.
- A rectification request may be made verbally or in writing - no formal requirements
- The controller must react within one calendar month of receipt
- As a courtesy, the controller should restrict processing while it verifies accuracy
- If refused: inform the individual without undue delay of the reasons, the right to complain to a DPA, and the right to a judicial remedy
- If granted and data were shared: contact and inform third parties of the rectification (unless impossible or disproportionate - then document)
Rectification is closely tied to the accuracy principle in Article 5(1)(d). Examiners may test that link.