Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated text

Article 16 Right to rectification

Summary What does Article 16 of the GDPR regulation say?

This brief but important article establishes the data subject's right to rectification.

It covers two distinct scenarios: the correction of inaccurate data and the completion of incomplete data.

The article connects closely to the broader set of data subject rights in Chapter III of the GDPR, and controllers should read it alongside Article 19, which requires them to notify recipients of any rectification carried out.

Important points:

Controllers are obligated to rectify inaccurate personal data concerning a data subject without undue delay upon request.
Data subjects also have the right to have incomplete personal data completed, including through a supplementary statement.
The purposes of the processing must be taken into account when assessing whether data is incomplete and needs to be completed.

Springlex's summary of the article is a reading aid, not a substitute for the legal text.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Relevant recitals

Recital 59 Facilitating exercise of data rights

Modalities should be provided for facilitating the exercise of the data subject's rights under this Regulation, including mechanisms to request and, if applicable, obtain, free of charge, in particular, access to and rectification or erasure of personal data and the exercise of the right to object. The controller should also provide means for requests to be made electronically, especially where personal data are processed by electronic means. The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month and to give reasons where the controller does not intend to comply with any such requests.

Recital 65 Right to erasure and forgetting

A data subject should have the right to have personal data concerning him or her rectified and a ‘right to be forgotten’ where the retention of such data infringes this Regulation or Union or Member State law to which the controller is subject. In particular, a data subject should have the right to have his or her personal data erased and no longer processed where the personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed, where a data subject has withdrawn his or her consent or objects to the processing of personal data concerning him or her, or where the processing of his or her personal data does not otherwise comply with this Regulation. That right is relevant in particular where the data subject has given his or her consent as a child and is not fully aware of the risks involved by the processing, and later wants to remove such personal data, especially on the internet. The data subject should be able to exercise that right notwithstanding the fact that he or she is no longer a child. However, the further retention of the personal data should be lawful where it is necessary, for exercising the right of freedom of expression and information, for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, on the grounds of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or for the establishment, exercise or defence of legal claims.

Table of contents

Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.