Article 16 — Right to Rectification — shared requirements from Articles 16 and 19

Legal Provision

Right to rectification: establishes the data subject right to have inaccurate personal data rectified or completed if incomplete

Applies to entities processing personal data: data controllers.

Duty: the data controller must allow the data subject to request the correction of any inaccurate personal data.

Publicly available, accessible channels/means for data subjects to submit rectification requests (e.g., online forms, email contact points)
Documentation of procedures for reviewing and updating personal data.
Logs and records (like timestamps) of received rectification requests and actions taken.
Records of notifications made when data have been rectified.
Template communications to data subjects and third parties.
Categorisation practices distinguishing individuals (user types, profiles) when relevant.

Verification and assessment procedures to evaluate the accuracy and completeness of personal data upon receiving rectification requests.
Assessment of significance and impact of correction.
Contextual evaluations to ensure rectification is completed comprehensively and accurately.
Justification for delay or denial with documented reasoning.
Assessment and documentation of the nature and extent of corrections or additions made, particularly when the rectification significantly impacts the data subject.
Justified time extensions documented and communicated transparently to data subjects for complex rectification requests.

Periodic audits and reviews of request handling rectification processes and logs.
Verification of timelines and accuracy of rectification actions.
Continuous review and improvement of internal communication and handling protocols for data subject requests.