← GDPR · Data subject rights

Art.19 — Notifying recipients of rectification, erasure or restriction

medium data-subject-rightsthird-party

Requirement

The controller shall communicate any rectification, erasure or restriction to each recipient to whom the data was disclosed, unless this proves impossible or involves disproportionate effort, and shall tell the data subject about those recipients if they ask.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
recipientprocessorthird partythird partiesdownstreampartnersub-processor
Required element 2 — any one of
notifyinformcommunicatepropagatepass oncascade
Required element 3 — any one of
rectif…erasuredeletiondeleterestrictioncorrectionerasecorrect
Supporting terms — specificity signals
article 19disproportionate efforton requestlist of recipients

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
CCPA/CPRA 1798.100(d) Contracts with service providers, contractors and third parties third-party
CCPA/CPRA 1798.105 Right to delete data-subject-rights
CCPA/CPRA 1798.106 Right to correct data-subject-rights
CCPA/CPRA 1798.110 & 1798.115 Right to know and access data-subject-rights
CCPA/CPRA 1798.125 Non-discrimination and financial incentives data-subject-rights
CCPA/CPRA 1798.130(a)(1)-(2) Methods for requests and 45-day response data-subject-rights
CCPA/CPRA Regs (ADMT) Automated decision-making technology for significant decisions data-subject-rights
SOC 2 CC9.2 Vendor and business partner risk management third-party