The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Article 16
Right to rectification
Understanding This Article
Article 16 establishes the data subject's right to rectification, ensuring personal data remains accurate and up-to-date. This right has two components: correcting inaccurate data and completing incomplete data.
The first component requires controllers to rectify inaccurate personal data 'without undue delay' upon request. What constitutes 'inaccurate' must be assessed objectively - data is inaccurate if it doesn't correctly reflect reality or contains errors.
The second component addresses incomplete data. Taking into account the purposes of processing, data subjects can request that incomplete information be supplemented. This might involve adding missing fields or providing a supplementary statement to add context.
This right supports the accuracy principle in Article 5(1)(d) and is closely linked to Article 19, which requires controllers to notify recipients of any rectifications.
Key Points
- Right to correct inaccurate personal data without undue delay
- Right to complete incomplete personal data
- Can provide supplementary statement to complete data
- Must be considered in light of processing purposes
- Complements the accuracy principle in Article 5(1)(d)
Practical Application
Examples of Rectification Requests:
- Correcting a misspelled name in customer records
- Updating an old address that's no longer current
- Fixing an incorrect date of birth
- Correcting inaccurate employment history in HR systems
Examples of Completion Requests:
- Adding a middle name that was omitted
- Providing additional context about a complaint or incident
- Supplementing incomplete medical history with relevant information
Best Practices:
- Establish clear procedures for handling rectification requests
- Respond without undue delay (typically within one month per Article 12(3))
- Verify the requester's identity before making changes
- Notify all recipients of the data about rectifications (Article 19)
- Keep records of rectification requests and actions taken
- Consider whether supplementary statements should be added to the record or replace existing data