As the third week in the series, after the right to access, we’ll cover the third right – that of rectification. Here, people have the right to have inaccurate personal data corrected or completed.

Linked to the GDPR principle of accuracy, and similarly to the right of access, people can make a request of their data, and ask for it to be changed if it’s incorrect.

Rectification Request

A request can be made verbally or in writing, including from social media, it’s valid as long it’s clear that someone is asking to change their own personal data.

Once you receive a request, you should restrict the processing of the personal data in question whilst you are verifying it.

Then you should take steps, within a month, to make sure that the data is accurate, and to rectify the data if necessary.

These steps may depend on the type of the personal data, what it will be used for, and the purposes for the processing. If it’s important that the data is accurate, more effort should be put into checking that it’s accurate and to rectify it.

After receiving the initial request, you should restrict the processing of the personal data in question whilst you are verifying it.

You can refuse a request if it’s manifestly unfounded or excessive, but these must be decided on a case-by-case basis.

There are some further reasons to refuse a rectification request, depending on the situation. Next week we’ll cover the right to erasure. If you want more information, or some advice on dealing with data privacy rights, feel free to contact us.