← GDPR · Data subject rights
Art.19 — Notifying recipients of rectification, erasure or restriction
Requirement
The controller shall communicate any rectification, erasure or restriction to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort, and shall tell the data subject about those recipients if they ask.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| CCPA/CPRA | 1798.100(d) | Contracts with service providers, contractors and third parties | third-party |
| CCPA/CPRA | 1798.105 | Right to delete | data-subject-rights |
| CCPA/CPRA | 1798.106 | Right to correct | data-subject-rights |
| CCPA/CPRA | 1798.110 & 1798.115 | Right to know and access | data-subject-rights |
| CCPA/CPRA | 1798.125 | Non-discrimination and financial incentives | data-subject-rights |
| CCPA/CPRA | 1798.130(a)(1)-(2) | Methods for requests and 45-day response | data-subject-rights |
| CCPA/CPRA | Regs (ADMT) | Automated decision-making technology for significant decisions | data-subject-rights |
| SOC 2 | CC9.2 | Vendor and business partner risk management | third-party |