ThomasMoreAI Processing Right to Rectification
Overview
The right to rectification under GDPR Article 16 gives data subjects the right to have inaccurate personal data corrected without undue delay, and to have incomplete personal data completed. This skill provides the complete workflow for receiving, verifying, implementing, and confirming rectification requests.
Legal Foundation
GDPR Article 16 — Right to Rectification
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
GDPR Article 19 — Notification Obligation
The controller shall communicate any rectification to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
GDPR Article 5(1)(d) — Accuracy Principle
Personal data shall be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
Rectification Processing Workflow
Step 1: Receive and Log the Request
- Log the request with reference REC-YYYY-NNNN.
- Record the specific data the subject claims is inaccurate or incomplete.
- Record what the subject asserts the correct or complete data should be.
- Record any supporting evidence provided.
- Send acknowledgement within 3 business days.
- Verify identity using tiered verification.
Step 2: Identify Affected Data
- Locate the specific data items cited as inaccurate across all systems:
- CRM and customer database
- Marketing platforms
- Analytics systems
- Third-party processors
- Backup systems
- Document the current value of each data item.
- Document the correction requested for each item.
Step 3: Verify the Correction
Two types of rectification require different verification:
Type A: Correction of Inaccurate Data
| Data Category | Verification Method | Example |
|---|---|---|
| Name / spelling | Accept subject's assertion unless reason to doubt | Subject states name is "MacLeod" not "McLeod" — accept |
| Date of birth | Request documentary evidence (passport, birth certificate) | Subject provides passport scan showing correct DOB |
| Address | Accept subject's assertion for current address; verify historical addresses against postal records if relevant | Subject provides utility bill as confirmation |
| Employment details | Accept subject's assertion or verify with employer (with subject's consent) | Subject states correct job title |
| Financial data | Verify against source records (bank statements, invoices) | Cross-reference with payment processor records |
| Technical data (IP, device) | Assess whether correction is factually possible — these are system-generated observations | If system logs show IP X, correction may not be appropriate unless a logging error occurred |
Type B: Completion of Incomplete Data
- Assess whether the additional data is relevant to the purposes of processing.
- If relevant, add the supplementary data.
- If not relevant (i.e., the additional data is not necessary for any processing purpose), the controller may decline to add it but should inform the subject of the reason.
Step 4: Decision
| Scenario | Action |
|---|---|
| Verification confirms inaccuracy | Rectify the data across all systems |
| Verification is inconclusive | Apply restriction under Art. 18(1)(a) while investigation continues |
| Verification confirms data is accurate | Inform the subject that the data has been verified as accurate; note the subject's objection; offer the right to add a supplementary statement |
| Completion request is relevant | Add the supplementary data |
| Completion request is not relevant to processing purposes | Decline with explanation |
Step 5: Implement the Rectification
- Update the data across all primary systems simultaneously (or as close to simultaneously as technically feasible).
- Update any derived data or reports that incorporate the inaccurate data.
- Flag data in backup systems for correction at next rotation.
- Document:
- Original value
- Corrected value
- Date of rectification
- Systems updated
- Person who implemented the change
Step 6: Notify Recipients Under Art. 19
- Identify all recipients who received the inaccurate data (reference Art. 30 records).
- Send rectification notification to each recipient:
- The specific data that has been corrected (without disclosing the subject's identity where possible)
- The corrected value
- Instruction to update their records accordingly
- 14-day confirmation deadline
- Log all notifications and confirmations.
Step 7: Confirm to the Data Subject
Within the 30-day response deadline, send confirmation including:
- The specific data items that have been rectified
- The corrected values now held
- Confirmation that all systems have been updated
- Expected completion date for backup system corrections (if applicable)
- List of third-party recipients notified (if requested by the subject)
- If any part of the rectification was declined, the reasons and the subject's right to complain
Response Timeline
- Standard deadline: 30 calendar days from receipt of the request.
- Extension: Up to 60 additional days for complex cases (Art. 12(3)).
- Implementation target: Rectification should be applied to primary systems within 5 business days of the verification decision, even if the formal response is still being prepared.