Data Governance Atlas UK edition

Rectification

How to handle a request to correct inaccurate personal data or complete incomplete data under UK GDPR Art 16, including restricting use while accuracy is checked and telling the people you shared it with.

Applies to
Any controller under the UK GDPR. Part 3 (law enforcement) has its own rectification right in DPA 2018 s.46.
Instruments
UK GDPR, DPA 2018
Steps
9 steps, with a deadline calculator.

Deadline calculator

Other data subject rights request

Rectification, erasure, restriction, portability, objection and automated decision requests: one calendar month from receipt, extendable by two further months for complex or numerous requests. Same counting as subject access.

Enter a date to calculate.

Basis: UK GDPR Art 12(3) and Art 12A. Bank holidays for 2025 to 2028, by the standard calendar rules. A calculator, not advice.

Mechanics

Item Position
Deadline One calendar month from receipt
Extension Two further months for complex or numerous requests, notified within the first month
Stop the clock While reasonably waiting for identity or clarification (Art 12A)
Cost Free; a reasonable fee or refusal only if manifestly unfounded or excessive
Recipients Tell each recipient of the data about the correction, unless impossible or disproportionate (Art 19)

Steps

  1. Recognise and log the request

    A request can be made in any form and need not mention Art 16. Log the date received: the one-month clock runs from receipt.

    See UK GDPR

  2. Verify identity only if in genuine doubt

    Ask for proportionate evidence only where you genuinely doubt who is asking. The clock stops while you reasonably wait.

    See UK GDPR

  3. Consider restricting while you check

    If the person contests accuracy, they can ask you to restrict processing while you verify it (Art 18(1)(a)). Restrict promptly if asked.

    See UK GDPR

  4. Decide whether the data is inaccurate or incomplete

    Data is inaccurate if it is incorrect or misleading as to any matter of fact. A record of an opinion is not inaccurate because the person disagrees with it, if it accurately records the opinion; add their view as a supplementary statement instead.

    See UK GDPR

  5. Correct or complete

    Correct the data in every system where it is held, including copies, and complete it with a supplementary statement where that is what is needed.

    See UK GDPR

  6. Tell recipients

    Tell each recipient you disclosed the data to about the correction, unless that is impossible or involves disproportionate effort, and tell the person who the recipients are if they ask (Art 19).

    See UK GDPR

  7. Respond within one month

    Confirm what you did, or explain why you have not corrected the data. Extend by up to two months only for complexity or numbers, telling the person within the first month.

    See UK GDPR

  8. Refuse only with reasons

    If you do not act, tell the person within the deadline why, and that they can complain to you, then to the Information Commission, and seek a judicial remedy. Manifestly unfounded or excessive requests may be refused, but you must be able to show why.

    See UK GDPR

  9. Handle any complaint

    A dissatisfied requester complains to you first under your s.164A process (complaints received from 2026-06-19), then to the Information Commission.

    See DPA 2018

Checklists and tools for this procedure

Explainers

Sources