Right to rectification — correct inaccurate data (GDPR Art. 16)

The right to rectification (GDPR Art. 16) gives you the right to have inaccurate personal data corrected and incomplete data supplemented. Two scenarios: (1) Correction — e.g. wrong date of birth on a hospital record, address typo at your bank, wrong payment status at a webshop. (2) Supplementation — e.g. adding a clarifying statement to an incomplete file (think: medical record missing a fact that could lead to wrong treatment). How to request? Written request (email is fine) with: your identification, which specific data is inaccurate, and what the correct data should be. Attach evidence — passport copy for identity corrections, bank statement for payment corrections, doctor's letter for medical corrections. Response time: 1 month, extendable by 2 months for complex requests (Art. 12(3)). What must the business do? Not only correct the data in their own system, but also take reasonable steps to inform third parties who previously received the data (Art. 19) — e.g. partners, credit bureaus, marketing partners. Burden of proof: you must make it plausible that the data is inaccurate. The business doesn't need to "agree" — if the evidence is sound, they must correct. If they refuse? They must justify, not just say "we got this data from a trusted source". Appeal via complaint to AP (Art. 77) or civil court (Art. 82). Difference vs erasure: rectification keeps the data, just changes it. Erasure wipes it entirely. Sometimes you request both: correct this, and if you can't, then delete it.