GDPR Article 16: right to rectification

Article 16 is the shortest of the GDPR's data subject rights, a single sentence in two halves, and it is routinely implemented as if only the first half existed. The second half, the right to have incomplete data completed, is the one that changes how a request process has to be built.

The official text

The consolidated text of Article 16 reads in full:

"The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement."

Two rights, in one sentence, with different triggers. The first is engaged by inaccuracy. The second is engaged by incompleteness and is expressly qualified by the purposes of the processing.

What "without undue delay" means in practice

Article 16 does not give a number. The number comes from Article 12(3), which governs all the rights in Articles 15 to 22: the controller shall provide information on action taken without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests, and the controller must inform the data subject of any such extension within one month of receipt, together with the reasons for the delay.

"Without undue delay" is therefore not a synonym for "within a month". It is a separate standard sitting inside the outer deadline. A correction that could have been made in two days is not defensible at week four merely because the month has not run out.

The completion right is the one that gets missed

The second sentence exists because personal data can be factually true and still mislead. A file recording that an employee was the subject of a complaint, without recording that the complaint was dismissed, contains no false statement and is nonetheless incomplete for the purpose it is used for.

The Regulation names the remedy: completion "including by means of providing a supplementary statement". That is a narrower instruction than it sounds. It means a controller can satisfy the right by appending the data subject's own statement to the record, rather than by rewriting the original entry. For records that must remain immutable, an audit log, a decision file, a clinical note, this is often the only workable route, and the Regulation contemplates it directly.

The qualifier "taking into account the purposes of the processing" limits the right in the other direction. Completeness is judged against what the data is for, not in the abstract. A marketing list does not become incomplete because it lacks a middle name.

Restriction is the interim remedy when accuracy is disputed

Rectification requests frequently arrive as disagreements rather than corrections. The Regulation anticipates this. Article 18(1)(a) gives the data subject the right to obtain restriction of processing where "the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data".

That turns a stalled dispute into a defined state. Rather than continuing to process contested data while an investigation runs, the controller restricts it, verifies, and then either rectifies under Article 16 or lifts the restriction. Building the restriction step into the workflow is what prevents a rectification request from becoming a complaint to a supervisory authority.

The downstream duty in Article 19

Correcting your own database is half the obligation. Article 19 requires the controller to communicate any rectification of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort, and to inform the data subject about those recipients if the data subject requests it.

For most modern stacks the recipients are processors, analytics platforms, CRM and support tools, and any partner given a data feed. The exemption for disproportionate effort is real but is an exception to be reasoned about, not a default. If you know exactly where the record went because your integrations are documented, the effort is unlikely to be disproportionate.

How Article 16 relates to the accuracy principle

Article 16 is the individual's enforcement route for a duty the controller already owes independently. Under Article 5(1)(d) personal data must be accurate and, where necessary, kept up to date, and every reasonable step must be taken to ensure that inaccurate data are erased or rectified without delay, having regard to the purposes for which they are processed.

The practical consequence is that a controller waiting for rectification requests to arrive is running the accuracy principle backwards. Article 5(1)(d) requires proactive steps; Article 16 is what happens when those steps have not caught something.

Building the process

Three design decisions cover most of it. Accept rectification requests through the same channel as access requests, because data subjects rarely categorise their own request correctly and a request labelled "my details are wrong" may be either. Record the date of receipt explicitly, since Article 12(3) runs from receipt and an extension notice must go out inside the first month. And decide in advance, per system, whether a correction is an overwrite or a supplementary statement, because that decision cannot sensibly be made per request under time pressure.

Next step