[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F16":3},{"item":4,"lessons":16,"controls":30,"related":45},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","16","Article 16","Right to rectification",3,"General Data Protection Regulation","**What it asks for.** Individuals have the right to have inaccurate personal data about them corrected without undue delay, and to have incomplete data completed, including by providing a supplementary statement, taking into account the purposes of the processing.\n\n**In practice.** Organisations need a defined route for rectification requests, identity verification proportionate to the risk, and the ability to locate and correct the data across all systems, including backups and data shared with processors. Under Article 12 the response is normally due within one month, and Article 19 requires informing recipients of the correction unless this is impossible or involves disproportionate effort. Evidence includes a request log with dates, the action taken, and confirmation that downstream systems and recipients were updated.\n\n**Common gaps.** Corrections are often made in one front-end system but not in data warehouses, CRM copies or third parties, and organisations rarely record whether recipients were notified.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_16","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18,22,26],{"slug":19,"title":20,"published_at":21},"cerved-fined-400k-for-failing-to-honor-gdpr-data-subject-rights","Cerved Fined €400K for Failing to Honor GDPR Data Subject Rights","2026-09-01T20:20:58.058+00:00",{"slug":23,"title":24,"published_at":25},"cerved-fined-400k-for-failing-to-honor-data-subject-rights-under-gdpr","Cerved Fined €400K for Failing to Honor Data Subject Rights Under GDPR","2026-09-01T10:22:28.543+00:00",{"slug":27,"title":28,"published_at":29},"identity-verification-failure-leads-to-wrong-man-detained-on-revil-warrant","Identity Verification Failure Leads to Wrong Man Detained on REvil Warrant","2026-07-17T12:21:28.092+00:00",[31,36,41],{"slug":32,"name":33,"problem":34,"stories":35},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",2,{"slug":37,"name":38,"problem":39,"stories":40},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",1,{"slug":42,"name":43,"problem":44,"stories":40},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[46,51,55,59,63,67,71,75],{"family":47,"item":48,"code":49,"title":50,"together":9},"cis","3","Control 3","Data Protection",{"family":52,"item":53,"code":54,"title":54,"together":9},"itil","overview","ITIL",{"family":5,"item":56,"code":57,"title":58,"together":35},"5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":5,"item":60,"code":61,"title":62,"together":35},"15","Article 15","Right of access by the data subject",{"family":64,"item":53,"code":65,"title":66,"together":35},"nist-privacy","Privacy Framework","NIST Privacy Framework",{"family":5,"item":68,"code":69,"title":70,"together":40},"22","Article 22","Automated individual decision-making, including profiling",{"family":5,"item":72,"code":73,"title":74,"together":40},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":5,"item":53,"code":76,"title":77,"together":40},"GDPR","General Data Protection Regulation (GDPR)"]