Right to correction: fixing inaccurate personal data

Section 43 of the Data Protection Act, 2024 gives a data subject the right to have inaccurate personal data about them corrected, and incomplete data completed. It is one of the more straightforward rights in Part VIII: there is no list of grounds to satisfy or exceptions to check against, just a factual question of whether the data on file is right.

A customer asking a business to fix a misspelled name or an outdated address on their account is the everyday version of this right in action.

What section 43 covers

The data subject shall have the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning him or her, and, taking into account the purpose of processing, to have incomplete personal data completed, including providing a supplementary statement. (s.43)

That is two things bundled into one right. The first is rectification: fixing something that is factually wrong, like a misspelled name, an old phone number, or an incorrect date of birth. The second is completion: filling in a gap, which can be done by adding a supplementary statement rather than needing to rebuild the whole record.

Correcting the record everywhere it exists

A correction is not much use if the wrong version of the data lives on somewhere else. Section 46 addresses that directly:

The data controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with sections 43, 44 or 45 to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. (s.46(1))

So if a business shared the customer’s old address with a courier company or a payment processor before the correction was made, it has to pass the correction along to them too, unless doing so is genuinely impossible or disproportionately difficult. Section 46(2) also gives the data subject the right to ask the controller who those recipients were.

How the request works

Correction is one of the rights covered by section 38’s response process, so the same one-month deadline applies, with the same possible two-month extension for complex requests. See how to exercise your rights for the full mechanics of making a request and what a business has to do in response.

If the inaccurate data cannot simply be fixed and needs to go entirely, that is a different right: see right to deletion for when erasure, rather than correction, is the right ask.