Right to rectification: How to make a right to rectification request
–– 15 May 2019
Know your rights. It’s your right to ask an organisation to change an error or inaccuracy they may have relating to your personal data. This is known as the ‘right to rectification’.
This right is covered in Article 16 of the GDPR, as follows:
“The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.”
This guide will show you how to exercise your right to rectification, under what circumstances you can exercise this right and what to expect from organisations.
How do I get my data corrected?
To exercise the right to rectification you should inform the organisation that you want your personal data corrected. A request can be verbal, in writing or using our free tool Tapmydata.
Examples of common errors to personal data include but are not restricted to:
- Your name is misspelt
- You address is incorrect; such as a the wrong flat or house number, wrong postcode, wrong street name, town or city
- Your date of birth has the wrong day, month or year
- Details about your education or employment are incorrect or have information missing
- Errors on your credit report
When sending your request you should try to include the following:
- Why you believe the data is inaccurate or incomplete
- Explain how they should correct it
- Provide evidence of the inaccuracies
If you make a request verbally we recommend that you follow up in writing because doing so gives you proof of your actions should you need to challenge that organisation at a later date.
You should also outline in your request what data you want correcting, so the organisation can take the necessary steps to change this for you.
An organisation cannot charge you for making such requests, unless they are deemed unreasonable or excessive (the jury’s currently out on how these are defined!).
Use a tool, make life easier
I am not happy with the response, what can I do?
If you are still unsatisfied, you can make a complaint to the Information Commisioner’s Office (ICO).
What should organisations do?
When you ask the organisation to correct your data, it should take steps to investigate whether the data is accurate, and should be able to say when this is done. To do this it should consider your arguments and any evidence you provide.
The organisation should then contact you and either:
- Confirm your data has been corrected, deleted or added to the data
- Inform you it will not correct the data and explain why
If the organisation has disclosed the data to other organisations, it must contact them and tell them the data which was corrected, unless this is impossible.
Can the organisation say no?
In most cases no. But the organisation can refuse to comply with a right to rectification request if it believes that the request is what the law calls “manifestly unfounded or excessive”. Remember though, the organisation should inform you of this outcome.
If the request is unreasonable or excessive the organisation can:
- Request a reasonable fee to deal with the request
- Refuse to deal with the request.
In either case it will need to tell you and justify its decision.
When should I get a response?
The organisation has one month to respond to your objection. In certain circumstances it may need extra time to consider it and can take up to an extra two months. If it is going to do this, it should let you know within one month that it needs more time and why.
Will it cost me anything?
Generally, no! Organisations can only charge a fee if the request is as the law states “manifestly unfounded or excessive”. The organisation then may be able to ask for a fee for admin costs associated with your request.