What does GDPR Article 19 require after a rectification or erasure?

Fixing a data subject's record, deleting it, or restricting how it is processed is only half the job if copies of the old version are still sitting with someone else. Article 19 is the provision that makes the controller go find those copies.

The article in full

Article 19 is short enough to quote entirely, and reading both sentences together is the fastest way to understand what it does. "The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it."

Three separate rights trigger the duty: a rectification under Article 16, an erasure under Article 17(1), and a restriction under Article 18. Whichever of those three a controller carries out, the same downstream notification duty follows.

Why this provision gets missed

Most implementations of the right to rectification, erasure, and restriction stop at the controller's own systems. The data gets fixed, deleted, or flagged restricted in the database where the request was handled, and the ticket closes. Article 19 asks a different question: who else has a copy of the version you just changed?

If personal data was disclosed to a processor, a joint controller, a business partner, or any other recipient before the rectification, erasure, or restriction happened, that recipient is now holding an out-of-date or improperly retained copy unless the controller tells them to update it too. A rectification that never reaches a recipient is a rectification that only half worked, because the inaccurate version is still circulating.

The impossibility and disproportionate-effort exception

The article gives controllers one way out: when notifying a recipient proves impossible or involves disproportionate effort. Neither phrase is defined inside Article 19 itself, which means the controller bears the burden of justifying it when challenged. A controller that disclosed data to a handful of known service providers has little room to claim impossibility. A controller whose data passed through a long, poorly documented chain of downstream recipients has a more credible case, but still has to be able to explain what made notification disproportionate rather than simply assert it.

In practice, this exception rewards controllers who already keep a clear record of recipients at the time of disclosure. If you know exactly who received a piece of data, telling them about a later rectification is rarely impossible. The exception exists for genuinely hard cases, not as a general escape hatch.

The data subject's separate right to know who was told

The second sentence of Article 19 operates independently of the first. Even where notifying every recipient was impossible or disproportionate, the data subject can still ask who the recipients were, and the controller has to answer. This mirrors a transparency theme that runs through the GDPR's data subject rights generally: even where an operational duty has a practical limit, the underlying transparency obligation does not disappear with it.

Where Article 19 sits in the broader framework

Article 19 is the connective tissue between the individual rights in Articles 16 through 18 and the practical reality that personal data rarely stays inside one system. A controller that has mapped its data sharing relationships, and can say with confidence who has received what, is in a far better position to satisfy Article 19 than one that discovers its recipient list only when a rectification request forces the question.

Next step

Honoring a rectification, erasure, or restriction request inside your own systems is necessary but not sufficient under the GDPR. The free 2-minute Obligation Scan checks whether the GDPR applies to your business and flags the data subject rights, including the Article 19 notification duty, that come with it.