---
title: "Art. 19 GDPR: Notification obligation regarding rectification or erasure of personal data or restriction of processing"
canonical: "https://dposchool.com/gdpr/article/19"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_19"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 19 GDPR · Chapter III: Rights of the data subject · Section 3: Rectification and erasure

# Article 19 GDPR: Notification obligation regarding rectification or erasure of personal data or restriction of processing

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

The controller must tell each recipient to whom personal data were disclosed about any rectification, erasure or restriction, unless this proves impossible or involves disproportionate effort, and must tell the data subject about those recipients if asked.

## Official text

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 19 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_19)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 59](https://dposchool.com/gdpr/recital/59)

## Court of Justice judgments

### Related (earlier law or other instruments)

#### [C-129/21, Proximus NV v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-129-21)

Judgment of 27 October 2022 · ECLI:EU:C:2022:833

Instrument: GDPR together with the ePrivacy Directive

Consent to appear in phone directories, given once, covers all directory publishers; a request to be removed is an erasure request, and the controller must inform other controllers it supplied.

[CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-129/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0129)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter III](https://dposchool.com/gdpr/chapter/3) / Article 19

Previous: [Art. 18 GDPR: Right to restriction of processing](https://dposchool.com/gdpr/article/18)

Next: [Art. 20 GDPR: Right to data portability](https://dposchool.com/gdpr/article/20)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents