The right to rectification gives the individual the ability to have inaccurate personal data concerning him or her corrected. Personal data is inaccurate if it is incorrect or misleading as to any matter of fact. This right also gives the individual the ability to have incomplete personal data completed, including by providing a supplementary statement.
Any rectification must be disclosed to each recipient to whom the personal data have been disclosed, unless it is impossible or involves disproportionate effort. The individual must be informed about those recipients if he or she so requests.
Under the right to restrict processing, an individual has the right to request restriction of the processing of his or her personal data where its accuracy is being contested and you are checking it. As a matter of good practice, processing of the personal data in question should be restricted while the accuracy of the personal data is being verified, whether or not the individual has exercised his or her right to restrict processing. The right to restrict processing will be the subject of a future blog.
If you are satisfied that the personal data is accurate or is complete, you should let the individual know and tell the individual that you will not be correcting or completing the personal data. You should explain your decision and inform the individual of his or her right to make a complaint to the appropriate supervisory authority and of the ability to seek to enforce his or her rights through a judicial remedy.
This blog is the seventh in a series of blogs that describes and explains the eight individual rights set forth in the GDPR. If you don’t want to wait until the next blog to learn more about the GDPR and the individual rights in the GDPR, take a look at GDPRsimple, http://www.keepgdprsimple.com, an automated web and mobile tool, that can help SMEs implement the GDPR and demonstrate their implementation.
Next blog: What is the right to erasure?