Accurate personal data is important, particularly where decisions are made about individuals based on that information.  Article 16 sets out the right to rectification of inaccurate data and Recital 65 provides additional guidance.

The law also explicitly states that, having regard to the purpose for processing the personal data, data subjects have the right to obtain completion of incomplete personal data "including by means of providing a supplementary statement".

If the controller has disclosed inaccurate personal data, Article 19 applies and the controller must advise each recipient of the data in question about the rectification and, if requested, the controller must inform the data subject about those recipients.

Action to be taken by controllers

Refusing a request

Controllers may refuse to comply with all or part of the request for rectification but must be able to justify its decision.

Requests may be refused in cases where:

Non-compliance with requests to exercise rights

If the controller is not taking action on the request of the individual to exercise any right, it must inform the individual “without delay” (and within ONE month of receipt of the request) about: