Art. 19 GDPR – Notification obligation regarding rectification or erasure of personal data or restriction of processing
| Sentence 1 | The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. | notify each recipient |
| Sentence 2 | The controller shall inform the data subject about those recipients if the data subject requests it. | name them on request |
Article 19 makes sure a correction, deletion or restriction doesn’t stop at your own systems. When you act on a request under Articles 16, 17(1) or 18, you have to tell everyone you disclosed the data to, unless that’s impossible or would take disproportionate effort. And if the person asks, you have to tell them who those recipients are.
In Proximus, the Court of Justice read Article 19 together with the accountability rules to require a directory provider to pass a consent withdrawal on to the other directory providers it supplied and, in the circumstances of that case, to the operator that supplied the data. Sweden reprimanded Klarna for not telling a customer which recipients had received his data. And authorities in Spain and Sweden fined Google over the reverse problem: passing details of removal requests to parties the law didn’t require it to tell (AEPD, €10.000.000; IMY, final fine SEK 50.000.000).
Key Facts
| Chapter | Chapter III – Rights of the data subject, Section 3: Rectification and erasure (Art. 16–20) |
|---|---|
| Addressed to | Controllers that have disclosed personal data to one or more recipients |
| Triggered by | Rectification under Art. 16, erasure under Art. 17(1) and restriction under Art. 18. Data you’ve made public is covered separately by Art. 17(2) |
| Exception | Notification proves impossible or involves disproportionate effort. The Swedish authority placed the burden of showing this on the controller (Klarna) |
| Maximum fine | €20.000.000 or 4% of worldwide annual turnover, whichever is higher, as an infringement of data subject rights under Art. 83(5)(b) |
| National classification | Spain lists failing to notify under Art. 19, and failing to tell the person who the recipients were, as minor infringements (LOPDGDD, Art. 74(e) and (f)) |
| Leading case | CJEU, C-129/21 Proximus, 27 Oct 2022 |
| In force since | 25 May 2018 |
| Works with | Art. 15(1)(c) (recipients in an access request), Art. 17(2) (data made public), Art. 24 and Art. 5(2) (accountability) |
When Article 19 Applies
Article 19 is a follow-on duty. It only bites once you’ve carried out one of three actions, and it covers everyone the data went to:
| You carried out | Under | What recipients need to hear |
|---|---|---|
| A rectification | Art. 16 | That the data was inaccurate or incomplete and has been corrected or completed |
| An erasure | Art. 17(1) | That the data has been erased. In Proximus, a withdrawal of consent to publication counted as an erasure request |
| A restriction | Art. 18 | That processing of the data has been restricted |
| A request from the person | Art. 19, second sentence | Nothing: this one runs the other way. You tell the person which recipients you notified |
Where you’ve made the data public, Art. 17(2) adds a separate duty to take reasonable steps to inform other controllers processing it, such as search engines. The Court applied both in Proximus.
EDPB Guidance and Enforcement Focus
These are the EDPB outputs that address Article 19 or the rights it follows from most directly:
| Topic | EDPB output | Key point |
|---|---|---|
| Keeping a list of recipients | Guidelines 01/2022 on the right of access (adopted for consultation 18 Jan 2022), para. 115, as cited by the Swedish authority | Storing information on the actual recipients is needed to comply with Arts. 5(2) and 19 |
| How erasure works in practice | Coordinated enforcement report on the right to erasure (Feb 2026) | 32 authorities and 764 controllers took part; nine authorities opened or continued formal investigations. Recurring problems included a lack of appropriate internal procedures for handling requests (see also Reed Smith) |
Decisions and Rulings Involving Article 19
These decisions and rulings either apply Article 19 or turn on who should, and shouldn’t, be told about a change:
| Case | Authority | Year | What was found | Outcome |
|---|---|---|---|---|
| Proximus | APD (Belgium), then CJEU | 2020, 2022 | Erased directory entry reappeared via an operator’s data feed; the Court held the withdrawal must be passed both downstream and upstream | €20.000 |
| Klarna Bank | IMY (Sweden) | 2022 | Didn’t name the recipients of a customer’s data when asked; Art. 15(1)(c) read with Art. 19 | Reprimand |
| Österreichische Post (C-154/21) | CJEU | 2023 | Individuals are entitled to the actual identity of recipients; the Court found this confirmed by Art. 19 | Ruling |
| Google LLC | IMY (Sweden) | 2020 | No legal basis for telling site owners about delistings; ordered to stop. Upheld on appeal | SEK 50.000.000 (final; IMY had set SEK 75.000.000) |
| Google LLC | AEPD (Spain) | 2022 | Forwarded erasure requests to the Lumen database without a legal basis | €10.000.000 |
Article 19 in Court
Both Court of Justice rulings came on questions about other articles, and both used Article 19 to decide them:
| Case | Question | What the Court said about Art. 19 | Source |
|---|---|---|---|
| Proximus (C-129/21), 27 Oct 2022 | Must a directory provider pass on a consent withdrawal? | Arts. 5(2) and 24, read with Art. 19, require it to inform the other providers it supplied and the operator that supplied it | Judgment, para. 83 |
| Österreichische Post (C-154/21), 12 Jan 2023 | Can a controller name only categories of recipient? | No, unless recipients can’t yet be identified or the request is manifestly unfounded or excessive. The Court saw this as confirmed by Art. 19 | Judgment, paras. 40–41 |
Recitals Behind the Rights in Article 19
No recital addresses Article 19 on its own. These explain the three rights it follows from.
Recital 65 – Right of rectification and erasurePeople should be able to have inaccurate data about them corrected and to have data erased where keeping it infringes the Regulation, particularly where they gave consent as a child and later want the data removed.
Recital 66 – Right to be forgottenA controller that has made data public should take reasonable steps, taking account of available technology and means, to inform other controllers processing the data of the erasure request, including removing links, copies or replications.
Recital 67 – Restriction of processingRestriction can be achieved by, for example, moving data to another system, making it unavailable to users or temporarily removing published data from a website, with the restriction clearly indicated in the system.
Checklist: Passing Changes Downstream
- Record who each dataset goes to by name, not just by category. You’ll need the list both for Art. 19 notifications and for access requests (Klarna)
- Build rectification, erasure and restriction workflows so the change reaches every recipient, not only your own database (Proximus)
- Check your inbound feeds too. If a partner keeps sending you data that someone has asked you to erase, tell the source, or the data will come back (Proximus)
- Treat a consent withdrawal as potentially triggering erasure and onward notification, not just an internal flag change (Proximus)
- If you rely on “impossible or disproportionate effort,” document why at the time. The Swedish authority noted Klarna hadn’t shown either (Klarna)
- Passing details of a request to anyone else is processing in its own right and needs its own legal basis. Spain and Sweden both fined Google for this (AEPD, IMY)
Consent withdrawals are the Article 19 trigger most organisations miss. A consent record that shows which vendors received data under each consent makes it possible to pass a withdrawal on to the right parties, and to name them if the person asks.