The right to rectification is the data protection right of an individual to have inaccurate personal data about them corrected and incomplete personal data completed by the organization that controls it. Among user rights in privacy law, it is set out most explicitly in Article 16 of the GDPR, and comparable rights exist in other regimes, such as the right to correct under the California Consumer Privacy Act as amended by the CPRA.
The right follows from the accuracy principle: personal data must be accurate and, where necessary, kept up to date. Rectification gives the data subject a direct way to enforce that principle when an organization holds wrong information that can affect decisions about them.
What the right to rectification covers
Under the GDPR, the right has two parts. The first is correction of data that is factually inaccurate, such as a misspelled name, a wrong address or an incorrect date of birth. The second is completion of incomplete data, which the controller may achieve by adding a supplementary statement from the data subject, taking into account the purposes of the processing.
| Situation | Covered by rectification | Comment |
|---|---|---|
| Factual error in stored data | Yes | Core case, for example a wrong account number |
| Outdated information | Yes, where accuracy requires updating | Depends on the purpose of processing |
| Incomplete record | Yes, by completion or supplementary statement | Missing context that changes meaning |
| Disputed opinion or assessment | Limited | Record may note the individual’s disagreement |
| Accurate data the person dislikes | No | Other rights, such as erasure, may apply |
Opinions and professional assessments need careful handling. A doctor’s diagnosis or a manager’s performance review is not inaccurate merely because the person disagrees with it. However, the record should accurately show that it is an opinion, and the individual’s view can often be added as a statement rather than replacing the original entry.
How a rectification request is handled
A rectification request can be made orally or in writing, and the GDPR does not require a specific form or wording. Organizations therefore need a process that recognizes requests arriving through customer service, email or chat, not only through a formal DSAR portal.
- Receive and log the request, recording the date it arrived, because the deadline starts then.
- Verify identity proportionately, so that data is not changed at the request of an impostor.
- Assess accuracy, using evidence from the individual or internal records where necessary.
- Restrict processing while accuracy is being checked, if the individual requests it.
- Correct or complete the data in every system and copy where it is held, including backups on their next restore cycle.
- Notify recipients to whom the data was disclosed, unless this is impossible or involves disproportionate effort.
- Respond to the individual, confirming the change or explaining a refusal and the right to complain.
The link to the right to restriction of processing is important. Under Article 18 GDPR, when a person contests accuracy, they can require the controller to restrict use of the data for the period needed to verify it, which prevents decisions from being based on possibly wrong data in the meantime.
Deadlines and rules in different legal regimes
The core idea is similar across jurisdictions, but deadlines, exceptions and terminology differ. The table below compares the main frameworks.
| Framework | Name of the right | Standard response time | Extension |
|---|---|---|---|
| GDPR and UK GDPR | Right to rectification | Without undue delay, at most one month | Two further months for complex requests |
| California CCPA and CPRA | Right to correct | 45 calendar days | Further 45 days with notice |
| Brazil LGPD | Correction of incomplete, inaccurate or outdated data | Set by law and regulation | Depends on the request type |
| Other US state laws | Right to correct inaccuracies | Usually 45 days | Usually 45 days |
In California, the business must use commercially reasonable efforts to correct the data and may consider the totality of the circumstances, including the nature of the information and documentation provided. A verifiable consumer request is required, and consumers may use an authorized agent to submit it.
Rectification compared with related user rights
Rectification is often exercised together with other rights. Understanding the differences helps organizations route requests correctly.
| Right | Purpose | Typical outcome |
|---|---|---|
| Right of access | See what data is held | Copy of the data and processing details |
| Right to rectification | Fix wrong or incomplete data | Corrected or completed record |
| Right to erasure | Remove data entirely | Deletion, subject to exceptions |
| Right to restriction of processing | Pause use while issues are resolved | Data stored but not used |
| Right to object | Stop processing for certain purposes | Processing ends unless overridden |
A request for access often reveals the errors that lead to a rectification request. Organizations that provide clear, complete access responses usually receive fewer repeated complaints, because individuals can identify the exact entries that need correction.
Common compliance failures
Regulators regularly find that organizations correct data in one place but not everywhere it is used. The distributed nature of modern data makes rectification harder than it appears.
- Partial correction: the CRM is updated, but marketing lists, analytics stores and partner feeds keep the old value.
- No notification to recipients, so credit bureaus, processors or affiliated companies continue to use wrong data.
- Excessive identity checks that demand documents far beyond what the risk justifies.
- Missed deadlines because requests arriving through informal channels are not recognized as rectification requests.
- Overwriting history in records where an audit trail is legally required, instead of adding a dated correction.
Explained without jargon
The right to rectification means a person can ask an organization to fix wrong information about them. A bank, a shop, an employer or a public office might have a wrong address, a misspelled name or an old phone number.
The person can tell the organization, and it must correct the mistake within a set time. It must also tell others who received the wrong data. Accurate records protect people from unfair decisions, such as a refused loan caused by an error.
A typical use case
A customer of an online electricity supplier in the European Union notices that her bills show a meter reading that belongs to a neighbor, which has raised her monthly payments. She emails customer service, attaches a photo of her meter and asks for the record to be corrected. She also asks the supplier to stop using the disputed figure until it is checked.
The supplier logs the email as a rectification request, restricts automated billing on her account and asks a technician to confirm the reading. Within twelve days, it corrects the record in the billing system, the payment plan and the data shared with the grid operator. It then confirms the change in writing. The customer’s bills are recalculated, and the supplier meets its one-month obligation with time to spare.