I asked for my data to be corrected but the company won't do it. What are my options?

What the Law Says

Under the General Data Protection Regulation (GDPR), you have a clear legal right to have inaccurate personal data corrected without undue delay.

Article 16 of the GDPR gives you the 'right to rectification': if your personal data is inaccurate or incomplete, you can request that the controller (e.g., a company) correct it. The controller must act without undue delay — and in any case within one month of receiving your request.

If the controller refuses your request, they must explain why — and inform you of your right to lodge a complaint with a supervisory authority (like your national data protection authority) and to seek a judicial remedy.

The GDPR also allows you to claim compensation for material or non-material damage resulting from an infringement — including harm caused by inaccurate data.

Statutory Text

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.

— Regulation (EU) 2016/679, Art. 16 — Right to rectification

Statutory Text

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority… every data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed.

— Regulation (EU) 2016/679, Art. 79 — Right to an effective judicial remedy against a controller or processor

Statutory Text

Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

— Regulation (EU) 2016/679, Art. 82 — Right to compensation and liability

What to Do

Sources