The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Article 19 GDPR - Notification obligation regarding rectification or erasure of personal data or restriction of processing
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
It must communicate any rectification under Article 16, erasure under Article 17(1) or restriction under Article 18 to each recipient to whom the personal data have been disclosed. The purpose is to make the exercise of these rights effective downstream, so that recipients do not continue working with data the originating controller has corrected, erased or frozen.
Yes. The controller is released where notification proves impossible or involves disproportionate effort. The Regulation does not define these thresholds, so the assessment turns on the circumstances of each case, and a controller relying on the exception should be able to demonstrate why it applies, in line with the accountability principle in Article 5(2).
Article 4(9) defines a recipient as any natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. Public authorities receiving data in the framework of a particular inquiry under Union or Member State law are not regarded as recipients under that definition.
Yes, but only on request. The second sentence of Article 19 obliges the controller to inform the data subject about those recipients if the data subject asks, which complements the access right in point (c) of Article 15(1) covering recipients or categories of recipient.
Not directly. The provision imposes the communication duty on the disclosing controller only, but a recipient acting as controller in its own right remains bound by the principles of Article 5 and by the data subject's rights exercised against it, so the notification will in practice often trigger corresponding action.