In short. A website operator acting as controller must notify recipients of personal data corrections unless this proves impossible or involves disproportionate effort.
Definition: Yes. Under GDPR Article 19, a website operator acting as controller must communicate a correction of personal data to each recipient to whom it disclosed that data, unless notification proves impossible or involves disproportionate effort.
Key facts
- Article 19 of the GDPR on EUR-Lex also requires the controller to inform the person concerned about those recipients if that person requests it.
- Ireland's Data Protection Commission explains in its rectification guidance that inaccurate personal data must be corrected without undue delay, and incomplete data can be completed with supplementary information.
- CNIL's guidance on exercising data rights, dated 5 January 2026, discusses available technologies and implementation costs when explaining disproportionate effort under Article 19.
Who counts as a recipient?
Personal data is information relating to an identified or identifiable individual. A controller is the person or organisation that determines why and how personal data is processed. These definitions appear in Article 4 of the GDPR; a website operator that determines those purposes and means has the controller's notification duty.
Article 4(9) defines a recipient as a person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. Public authorities receiving data within a particular inquiry under Union or Member State law are excluded from that definition. Article 19 addresses each recipient to whom the affected personal data has been disclosed.
When can notification be omitted?
Article 19 of the GDPR provides the exceptions: communicating the correction proves impossible or involves disproportionate effort. The exception concerns communicating a correction to recipients; Article 16 separately establishes the right to correction of inaccurate personal data without undue delay.
The controller also has an accountability obligation under Article 24: it must implement appropriate technical and organisational measures to ensure and demonstrate compliance, taking account of the processing and the risks to individuals. Those measures must be reviewed and updated where necessary.
How does this apply to shared web datasets?
In its guidance for AI system development, CNIL applies Article 19 to notification following the exercise of rights over training datasets. It recommends, where possible, application programming interfaces, or APIs, particularly in the riskiest cases. It also recommends techniques for logging data downloads.
For dataset sharing, the same guidance describes communicating dataset versions as good practice. It also recommends a contractual obligation, for example in a dataset reuse licence, requiring reusers to pass on the effects of rectification, objection or erasure requests. These are CNIL recommendations for implementing rights in a data sharing chain.
Related terms
FAQ
Must I separately ask the website to notify recipients?
Under GDPR Article 19, the controller must communicate the correction to recipients, subject to the exceptions. You can also request information about those recipients; the article expressly makes that disclosure to you dependent on a request.
Does the notification rule also cover deletion?
Yes. Article 19 covers erasure carried out under Article 17(1), as well as rectification under Article 16 and restriction of processing under Article 18. The same impossibility and disproportionate effort exceptions apply.
Sources
- EUR-Lex, "Regulation (EU) 2016/679", 4 May 2016
- Data Protection Commission, "The right to rectification", undated
- CNIL, "Ensuring and facilitating the exercise of data subjects’ rights", 5 January 2026
Check how a page reads to answer engines. Open the GEO score analyzer