A company refuses to correct inaccurate data about me. What can I do?

1 month

Response deadline

£1,000

Max small claims

3 months

ICO complaint window

GDPR Art 16

Right to rectification

The Short Answer

You can complain to the Information Commissioner’s Office (ICO), request an enforcement notice, or take court action for compensation if inaccurate personal data is not corrected.

What the Law Says

Under UK data protection law, you have a legal right to have inaccurate personal data about you corrected. Organisations must respond without undue delay — and in any case within one month.

The UK General Data Protection Regulation (UK GDPR) gives you the ‘right to rectification’. This means if a company holds inaccurate or incomplete personal data about you, you can ask them to correct it. They must do so without undue delay — and in any case within one month of receiving your request.

If the company refuses or fails to act, you may be entitled to compensation for material or non-material damage (e.g., distress) caused by the inaccuracy, provided you can show the controller failed to comply with their obligations.

The Data Protection Act 2018 supports and supplements the UK GDPR, setting out exemptions and enforcement powers for the Information Commissioner.

Statutory Text
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her.
— UK GDPR, Article 16 — Right to rectification

Statutory Text
Where a controller has made the personal data public and is obliged… to erase the personal data, the controller… shall take reasonable steps… to inform controllers which are processing the personal data that the data subject has requested the erasure…
— UK GDPR, Article 17(2) — Right to erasure (relevant where inaccuracy cannot be corrected)

What to Do

Make a clear, written rectification request to the company, quoting UK GDPR Article 16 and specifying the inaccurate data and how it should be corrected.

If they don’t respond within one month (or give a lawful reason for delay), complain to the Information Commissioner’s Office (ICO) within three months of the breach.

If the ICO upholds your complaint but the company still refuses, ask the ICO to issue an enforcement notice — or consider applying to court for an order or compensation.

In England and Wales, you can claim up to £10,000 in the County Court for non-material damage (e.g., distress); smaller claims (≤£10,000) go through the small claims track.

Sources

statuteUK GDPR, Article 16 — Right to rectification statuteUK GDPR, Article 17 — Right to erasure statuteData Protection Act 2018 guidanceInformation Commissioner’s Office (ICO) — Right to rectification

Same Question, Other Jurisdictions

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.