In short. The GDPR right to rectification requires correction of inaccurate personal data without undue delay and applies to relevant AI processing.

Definition: The GDPR right to rectification is the right under Article 16 of the General Data Protection Regulation (GDPR) to obtain correction, without undue delay, of inaccurate information relating to an identified or identifiable natural person. It also covers completing incomplete personal data, taking the purposes of processing into account.

Key facts

Article 16 of the GDPR expressly allows incomplete personal data to be completed through a supplementary statement.
The European Data Protection Board (EDPB), in its ChatGPT taskforce report of 23 May 2024, distinguishes input data from output data when discussing accuracy.
As of 17 October 2026, the EDPB's guide to respecting individuals' rights explains that organisations must respond to rights requests within one month, with an extension possible under specified conditions.

Who handles a rectification request?

The controller is the person or organisation that determines the purposes and means of processing personal data. The GDPR's Article 4 defines personal data as information relating to an identified or identifiable natural person and processing as operations including collection, storage and use.

Article 16 directs the correction request to that controller. For a website operator handling personal data, identifying the disputed processing and its controller is therefore the starting point. Article 2(1) covers processing wholly or partly by automated means, which is relevant when personal data passes through an AI system.

Under Article 16 of the GDPR, incomplete personal data can be completed through a supplementary statement, taking the purposes of processing into account.

How does rectification apply to AI processing?

The EDPB's ChatGPT taskforce report sets out preliminary views from coordinated investigations. It treats web-collected information and user prompts (inputs submitted to the service) as possible inputs, while outputs are the responses produced through interaction with the service. This distinction helps locate the inaccurate personal data involved in a request.

The report states that technical impossibility cannot justify non-compliance with GDPR requirements. It also explains that information warning users about unreliable outputs is insufficient to satisfy the accuracy principle.

On rectification specifically, the taskforce calls for continued improvement of the arrangements for exercising rights, discussing the practice of directing users towards erasure when correction is technically complex.

How must the controller handle the request?

Article 12 of the GDPR requires controllers to facilitate the exercise of rights. Information about action taken is due without undue delay and within one month of receipt. An extension of two further months is possible where necessary because of the complexity and number of requests; the controller must explain the extension within the initial month.

If no action is taken, the controller must explain why within one month and provide information about complaining to a supervisory authority and seeking a judicial remedy.

Article 19 requires communication of a rectification to recipients to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort. The individual can request information about those recipients.

FAQ

Can I request a restriction while accuracy is checked?

Yes. Under Article 18(1)(a) of the GDPR, you can obtain restriction of processing when you contest accuracy, for a period enabling the controller to verify the data. Article 18 also limits permitted uses during restriction and requires notice before it is lifted.

What does correcting personal data look like in practice?

The EDPB's individuals' rights guide gives the example of a customer who moves to another city: the organisation must change the customer's address in its database. For incomplete data, Article 16 also provides for completion through a supplementary statement, taking the processing purposes into account.

Sources

Check how a page reads to answer engines. Open the GEO score analyzer