Article 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

This short but practically significant article acts as a downstream obligation that flows from Articles 16, 17, and 18 — the rights to rectification, erasure, and restriction of processing.

Once a controller has acted on any of those rights, Article 19 ensures that the correction or change does not stop with the controller alone.

Any recipient who previously received the personal data must also be informed of the update, keeping the data ecosystem consistent.

There is a limited carve-out where notification is impossible or involves disproportionate effort.

Additionally, data subjects can request to know which recipients were informed.

Important points:

• Controllers are required to notify all recipients of any rectification, erasure, or restriction of processing applied to personal data they previously shared.
• This obligation has a narrow exception: notification is not required where it proves impossible or involves disproportionate effort.
• Inform the data subject of the recipients notified, but only if the data subject requests this information.