What it asks for. Individuals have the right to have inaccurate personal data about them corrected without undue delay, and to have incomplete data completed, including by providing a supplementary statement, taking into account the purposes of the processing.
In practice. Organisations need a defined route for rectification requests, identity verification proportionate to the risk, and the ability to locate and correct the data across all systems, including backups and data shared with processors. Under Article 12 the response is normally due within one month, and Article 19 requires informing recipients of the correction unless this is impossible or involves disproportionate effort. Evidence includes a request log with dates, the action taken, and confirmation that downstream systems and recipients were updated.
Common gaps. Corrections are often made in one front-end system but not in data warehouses, CRM copies or third parties, and organisations rarely record whether recipients were notified.