Right of rectification

The right of rectification is the right of the data subject to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning him or her and, taking into account the purposes of the processing, to have incomplete personal data completed, including by means of providing a supplementary statement (Art. 16 GDPR). It is the individual-rights counterpart of the accuracy principle in Art. 5(1)(d), and the controller must notify recipients of any rectification under Art. 19.

Rectification concerns matters of fact. Where the data records an opinion, diagnosis or assessment, the right does not entitle the individual to have the professional judgement changed, but it does allow a supplementary statement recording their disagreement. Requests must be answered within one month (Art. 12(3)), free of charge, and refusals must be reasoned with information on the right to complain to a supervisory authority.

In health and clinical research, rectification operates within data integrity constraints. A patient can require correction of an incorrect date of birth or medication list in their medical record; the correction is made through a documented amendment that preserves the original entry and the audit trail, as required by medical record legislation and by GCP (ALCOA+). In a clinical trial, corrections flow from the source document at the site to the eCRF via a data query, so the sponsor and site need an agreed procedure for participant requests. Where Member State law implements the Art. 89(2) research derogation, rectification may be limited if it would seriously impair research objectives, but simply overwriting historical trial data is never acceptable.