Right to Rectification and “Undue Delay” (GDPR Article 16)

1. The Legal Provision

Article 16 GDPR states:

“The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.”

So, controllers must correct inaccuracies promptly once notified by the data subject.

2. What Does “Undue Delay” Mean?

  • Not defined numerically in GDPR, but interpreted as:
    • “As soon as reasonably possible” in light of the context, risk, and resources.
    • Controllers cannot stall or create unnecessary obstacles.
  • The principle is about urgency — balancing operational feasibility with protecting the data subject's rights.

3. Timeline Guidance from GDPR and Supervisory Authorities

While GDPR does not fix a specific number of days for rectification, it aligns with timelines for data subject rights requests under Article 12(3):

  • Controllers must respond to data subject requests “without undue delay and in any event within one month”.
  • This one-month period is considered the maximum reasonable timeframe.
  • Extension: In complex or multiple requests, the deadline may be extended by two further months, but the data subject must be informed within the first month.

Therefore, in practice:

  • Simple corrections (e.g., updating an address, phone number, or spelling mistake) should be done within days.
  • Complex rectifications (e.g., involving linked systems, third parties, or large-scale datasets) may take longer, but should still be completed within one month unless a justified extension is communicated.

4. Practical Examples

  • Banking: A customer notices their surname is misspelled. Correction should take a few days at most, since it's a simple administrative update.
  • Healthcare: A patient requests correction of their allergy record. Rectification must be prioritized to protect health and safety — “undue delay” here means immediate action.
  • Insurance: A client disputes financial records. Investigation across multiple systems may justify more time, but rectification should still be finalized within one month.

✅ Conclusion

    #BBD0E0 »