GDPR Article 19: Notification Obligation for Rectification, Erasure, or Restriction of Processing

Article 19 of the GDPR Explained

When personal data has been rectified, erased or its processing is subject to a restriction (pursuant to Articles 16, 17 and 18), the controller must notify each recipient to whom the data has been disclosed.

They must also inform the data subject of these recipients, if the data subject so requests.

Why this article is important for your GDPR compliance

This article ensures **consistency in data updating or deletion**, even when shared with third parties. It is crucial to prevent recipients from continuing to process outdated or non-compliant data.

How to comply with Article 19 of the GDPR?

• Maintain a clear register of recipients to whom you transmit personal data.
• Automate notifications upon rectification, erasure, or restriction.
• Inform data subjects of third parties who have received their data upon request.
• Retain proof of notifications sent.

Examples of Applying GDPR Article 19

• A company rectifies an error in a customer's data and notifies its marketing sub-processors.
• After the deletion of a user profile, the emailing service provider is also informed to update its files.
• An employee requests to know which HR departments have been informed of the change to their surname.

Related Resources

• Official text of the GDPR – EUR-Lex
• Practical guides from the French supervisory authority
• European portal for data protection

Accelerate your compliance in a few clicks

• Automate your compliance with our GDPR software
• Supported or outsourced by our DPO experts
• Raise awareness among your teams with our GDPR training e-learning

👉 Request a demo with an expert

⚡ Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment:

👉 GDPR: Self-assess now