You can require inaccurate personal data to be corrected, and incomplete data may be completed where appropriate.
Article 16 UK GDPR gives individuals a right to rectification of inaccurate personal data. The accuracy principle separately requires organisations to take reasonable steps to keep personal data accurate and, where necessary, up to date.
Rectification is strongest where the disputed information is objectively wrong - name, date of birth, account status, balance, address, payment history or another verifiable fact. Disputes about opinions require more nuance because an accurately recorded opinion can remain personal data even if you disagree with it.
Key points
- A rectification request can be verbal or written.
- The ordinary response period is one month, subject to current time-limit rules.
- The controller should investigate the accuracy challenge, not merely restate the disputed data.
- Where data was disclosed to recipients, rectification can trigger duties to communicate the correction unless impossible/disproportionate.
Fact versus opinion
If a system records “DOB: 1 January 1950” and your birth certificate shows another date, the issue is straightforward factual accuracy. If a caseworker records “customer appeared frustrated”, the question may be whether that was genuinely the opinion recorded at the time, not whether you agree with it. A supplementary statement can sometimes be relevant.
Evidence and source status
Show the reliable source that proves the correct data. If different systems contain conflicting values, identify each system/report and ask the controller to reconcile them.
Restriction while accuracy is checked
Where you contest accuracy, the right to restriction may be available while the controller verifies it. This can be particularly important if the disputed data is being actively shared or used to make decisions.
In practice
- Identify the exact field/value to correct.
- Supply evidence of the correct value.
- Ask what recipients received the inaccurate data.
- Consider requesting restriction while the dispute is investigated.
What to do
A practical next-step plan
- List the inaccurate data.
- Provide the correct data and evidence.
- Request rectification and, where justified, restriction.
- Ask for confirmation of downstream recipient corrections.
- Check the data again after the response.
Common traps
Things that often confuse the issue
- Rectification is not a mechanism to delete an accurate record simply because it is embarrassing.
- Do not ask only for a note saying you disagree where the underlying fact is demonstrably wrong.
- Credit-file corrections may require both the data furnisher and CRA to update.
Evidence worth keeping
Correction should follow the data downstream where required.
Where rectified data was disclosed to recipients, the controller generally must communicate the rectification unless that is impossible or involves disproportionate effort; on request it should tell you about recipients. Ask for confirmation that source systems and relevant recipients have been corrected, not just that a customer-service note was added.
Useful wording.
“Please rectify the following personal data: [current entry] to [correct entry]. Evidence is attached. Please restrict the disputed data while checking it, update relevant source systems and notify recipients where required. If you refuse, explain the factual basis for concluding the existing data is accurate.”
The controller must investigate rather than simply prefer its database.
ICO guidance says the controller should take reasonable steps to satisfy itself that the data is accurate, taking account of your arguments and evidence. The importance of the data matters, where it drives significant decisions, stronger verification may be expected. If accuracy is contested, consider requesting restriction while the investigation takes place.
Opinions and historic mistakes require careful wording.
A record of an opinion is not automatically inaccurate because you disagree with it, particularly where it is clearly attributed as an opinion. Likewise, an accurate record that a mistake occurred may legitimately remain if the later correction is also recorded. Focus on whether the record is incorrect or misleading as a matter of fact, or incomplete for the purpose for which it is used.
A rectification request should specify the data, the error and the replacement.
The right covers inaccurate personal data and, depending on context, incomplete data. The quickest route is often a short schedule: current entry; why it is incorrect/misleading; correct entry or supplementary statement; evidence. A request can be verbal or written, but writing provides a useful audit trail.
Official sources
Check the rules behind this guide
ConsumerWise explains these materials in plain English. Check the current official source where a deadline, rule about what the body can deal with or legal requirement may have changed.