The General Data Protection Regulation (AVG) gives people the right to change inaccurate personal data. A data subject can also have their personal data supplemented. Under the AVG (Article 16), this right is called the "Right to rectification and completion.
A controller is always responsible for processing the correct personal data for the predetermined purposes. Sometimes a data controller may not be aware of changed data and therefore it is good practice for a data subject to communicate this themselves. The controller is then obliged to make the changes or additions within 1 month, sometimes after doing the necessary checks.
Of course, there may be weighty and exceptional reasons not to update personal data, for example if incorrect (new) data have been transmitted or the request is unreasonable. Such a refusal is therefore not allowed just like that. If such a situation arises, you are obliged to explain this to the data subject and point out their right to file a complaint with the Autoriteit Persoonsgegevens (AP).
As a data controller, have you passed on incorrect or incomplete personal data to third parties? If so, you are also obliged to pass on the amended or supplemented data to those parties. Keep in mind that a data subject may ask which parties those were and whether you informed those parties.
Furthermore, it is good to know that a legal representative may also exercise the Right to rectification and completion in case of personal data of a minor for which he/she is responsible. However, this only applies to minors up to 16 years of age. In fact, from the age of 16 a child has the right to do this himself.
Source: DMCC
