GDPR rectification of data request form

The UK GDPR provides the right for individuals to make a request to you for the rectification of their personal data, which they can do if they wish by completing our form.

The statutory right

The UK GDPR provides the right for individuals to require you to rectify any inaccurate personal data that you hold about them. They also have the right to have incomplete personal data completed, including by means of their providing a supplementary statement. An employee might ask you to correct personal details such as their home address or mobile phone number. You’ll then need to consider whether the personal data is inaccurate or incomplete and, if it is, you’ll need to amend it so that it is correct or complete. In the meantime, the employee may also exercise the right to request a restriction of processing while you verify the accuracy of the personal data. Unfortunately, a request for rectification might not be quite so straightforward to deal with. It’s possible, for example, that an employee is unhappy with the feedback given by their line manager in the context of their annual appraisal and so they submit a request to have what they consider to be inaccurate personal data rectified. That type of situation is going to be trickier to deal with if you dispute that the data is inaccurate. Although there’s no definition of “inaccurate” in the UK GDPR, the Data Protection Act 2018 defines this term, in relation to personal data, as being “incorrect or misleading as to any matter of fact”. So, in our example, it seems that you may decline the request if the data is factually correct and not misleading, even though the employee might not agree with the line manager’s opinions.

Form of request

As with the other individual data subject rights, there’s no specific format in which a rectification request should be made and you must still respond to rectification requests made by any means. However, you can also make available our GDPR Rectification of Data Request Form as a straightforward way for individuals to make rectification requests. It asks the applicant to provide their name, contact details and evidence of identity, along with such other information to enable you to identify both them and the personal data that they’re requesting be rectified.

Timescale for compliance

An individual has the right to require you to rectify their personal data without undue delay, and in any event within one month of receipt of the request. However, if the request is complex or the individual has made numerous other requests, you can extend the time period for response by two further months where necessary. If you want to exercise this limited right to extend, you must inform the individual within one month of receipt of their request, and you must also explain to them the reasons for the delay in responding.

Third parties

You must communicate any rectification of personal data carried out in accordance with a request to each third-party recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You must also inform the individual about those recipients if they ask you to do so.