Rectification in practice

Rectification looks like the simplest right in the regime and generates a surprising amount of complaint, because organisations consistently do three-quarters of it.

What the right actually is

An individual can require a controllerControllerDecides why and how personal data is processed. Carries most of the duties — and the fines. to correct inaccurate personal dataPersonal dataAny information relating to an identified or identifiable person: names, IDs, location, online identifiers, and combinations that single someone out. about them without undue delay, and to have incomplete data completed. It sits on top of the accuracy principle, which is an obligation that exists whether or not anyone complains: personal data must be accurate and, where necessary, kept up to date.

Two consequences follow that are easy to miss:

• The obligation is not triggered by the request. Accuracy is a standing duty. A request makes it acute and starts a clock; it does not create the duty.
• “Inaccurate” is broad. It is not limited to facts that are demonstrably false in a scientific sense. A title, a salutation, a recorded preference, an inference, a note saying someone was aggressive — all are personal data capable of being wrong.

The four things you must do, in order

1. Search properly. If the individual has already sent you the evidence, your search must find it. A response saying “we are unable to locate any such correspondence” when the material is in your systems is a records failure that will be exposed the moment a subject access request is made — and it converts a small complaint into a credibility problem.
2. Decide, and say what you decided. Either correct the data, or refuse and explain why, including the individual’s right to complain to the supervisory authority and to a judicial remedy. Silence is not a third option.
3. Notify recipients. Where you have disclosed the incorrect data to anyone else, you must communicate the rectification to each recipient unless it proves impossible or involves disproportionate effort — and tell the individual who those recipients are if they ask. This is the most-missed obligation on this page. Correcting your own record while leaving the wrong version with three third parties does not discharge it.
4. Do it within the time limit. Without undue delay and in any event within one month, extendable by two months for complex or numerous requests, provided you tell the individual about the extension and why inside the original month.

Acknowledging is not acting — and acting is not acknowledging

This distinction generates more escalations than any other part of the right.

An organisation that quietly starts using the correct title, but never responds to the challenge, has acted without acknowledging. From the individual’s side that is indistinguishable from being ignored, and it leaves the original inaccuracy unaddressed in the record. It also destroys your evidence: you cannot later show you handled the request properly, because there is nothing showing you handled it at all.

The reverse — acknowledging without acting — is more obviously deficient, but no more common.

Do both, and say you have done both. “We have corrected X in systems A and B, notified recipient C, and here is what happened to your original message” is a complete answer. It takes one paragraph and it ends the complaint.

Where the individual disputes accuracy and you disagree

You are not obliged to accept every assertion. Where accuracy is genuinely contested, the individual can require you to restrict processing while you verify — a pause, not a deletion. Restriction is underused and is often the right answer to a stand-off: it protects the individual while you investigate, and it demonstrates good faith.

If you conclude the data is accurate, record why. An opinion recorded as an opinion, with its source and date, is generally not inaccurate merely because the subject disagrees with it — but an opinion recorded as fact frequently is.

For the person making the request

• Say the word “rectification” and cite the article. It removes any argument about what kind of request this was.
• Attach the evidence again, even if you have sent it before, and say when you first sent it. That single sentence is what makes a later “we could not find it” untenable.
• Ask explicitly what happened to the original inaccurate record — not just whether it is right now. Present-tense correctness is not the same as rectification.
• Ask who else received it, and require notification under Art 19. Most people never ask, and most controllers never volunteer it.
• Set a date. “I expect a substantive response within one month, by [date]” makes delay measurable.

For the DPO receiving one

The failure mode is treating it as a customer-service ticket. The tells that it is not: the individual cites an article, refers to evidence previously supplied, or asks what happened to the earlier record. Any of those means the response has to come from someone who knows what Art 16 requires, and it has to be in writing.

If the request has been sitting unanswered for months, deal with that first and separately. Delay is the fact a regulator assesses before it assesses anything else, and it is the one you cannot argue with afterwards.