What Does “Right to Rectification” Mean When ChatGPT Gives My Business the Wrong Facts?

What does the right actually say?

Article 16 says a data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data about them. It also gives them the right to have incomplete data completed, including by a supplementary statement. Related rights sit alongside it. There is erasure (Article 17), restriction of processing while accuracy is checked (Article 18) and objection (Article 21). If a request is refused or ignored, there is the right to complain to a data protection authority (Article 77).

Organisations must respond within one month of receiving a request. They can extend that by two further months for complex requests, as long as they tell the person why within the first month.

Does it cover my business?

The UK regulator, the ICO, puts it this way. Information about companies is not personal data. But data protection law does apply to individuals acting as sole traders, employees, partners and company directors, where they are identifiable and the information relates to them as individuals.

So the question to ask is whose data it is. "[Company] charges $500 a month" is company data. "[Company]'s founder [Name] was sued for fraud" is personal data about the founder, and the founder can ask for it to be corrected.

What have OpenAI and regulators said?

An earlier version of OpenAI's privacy policy said that, given the technical complexity of how its models work, it may not be able to correct an inaccuracy in every instance. In that case, people can ask for their personal information to be removed from ChatGPT's output instead. The European Data Protection Board's ChatGPT taskforce reported in May 2024 that OpenAI encourages people to use erasure rather than rectification because of these technical challenges. The taskforce said ChatGPT must give users proper information about the probabilistic nature of its output and its limited reliability. It added that this alone is not enough to comply with the GDPR's accuracy principle.

Two complaints by the privacy group noyb are testing the point. The first, filed in Austria in April 2024, concerned a public figure's wrong date of birth, which OpenAI declined to correct. The second, filed with Norway's data protection authority in March 2025, concerned a Norwegian person whom ChatGPT falsely described as having murdered two of their own children. Ireland's Data Protection Commission is now the lead authority on that complaint, and it was still pending.

The practical upshot: an individual can make a request and may get output about them blocked. A clean correction inside the model itself is not something to count on.

How does an individual make a request?

1. Document the error. Save the prompts, the full answers, screenshots, the date and whether web search was used. How to document false AI statements properly is covered in how to document a false statement generated by an AI assistant.
2. Use OpenAI's privacy request portal or the privacy contact given in its privacy policy, rather than general support, so the request is logged as a data protection request.
3. Be specific. Name the right (rectification under Article 16) and quote the inaccurate statement. Give the correct information with evidence, such as a registry entry, licence record or court record.
4. Say what you want if correction is not possible, for example erasure of the inaccurate data or restriction of processing.
5. Track the deadline: one month, or up to three if OpenAI extends it and tells you why.
6. Complain to your data protection authority if the response is inadequate. In the UK that is the ICO. In EU countries it is the national authority, which may pass the case to Ireland's Data Protection Commission as lead authority for OpenAI.

For serious false allegations, such as crimes or fraud, get legal advice on defamation as well. Data protection and defamation are separate routes, and they can run together.

What should a business owner weigh before asking for removal?

Removal can have side effects. If OpenAI handles a request by filtering output about a person, ChatGPT may stop saying anything about them at all. For a sole trader or a practitioner whose business depends on being found, silence can be worse than a minor error. For a serious false allegation, blocking is usually worth it. For a wrong founding year, fixing the sources is the better route.

What can a company do when the wrong facts are about the business itself?

• Fix the sources. Most wrong company facts trace back to something on the web: an outdated page, a directory listing, an old news story, or details locked in PDFs, behind logins or in pages that load with JavaScript. Put the correct facts in plain text on your own site, and correct the listings and profiles assistants cite.
• Report the answer to OpenAI using the feedback and content-reporting options. How reporting works is covered in how to report a false allegation in ChatGPT through OpenAI's content reporting.
• Use individuals' rights where the error is about a person. If the false statement names the owner, a director or a staff member, that person can make a rectification request about it.
• Consider legal routes for damaging falsehoods, such as an invented scam warning or lawsuit, covered in what a business can do when ChatGPT falsely calls it a scam or invents a lawsuit.
• Recheck regularly. Answers that use web search can change once sources are fixed. Answers from model memory may lag until a newer model is released.

Does anything similar exist outside Europe?

In the US, California's privacy law gives California residents a right to have inaccurate personal information corrected by businesses it covers, and several other states have similar rights. Like the GDPR, these protect individuals, not companies. Elsewhere, rights vary. The practical route for company facts is the same everywhere: fix the sources and report the error.

What might an illustrative case look like?

Consider an illustrative electrician who trades under their own name in Ireland. ChatGPT tells customers the electrician's registration was withdrawn, which is false and costing them work. They save the answers and send OpenAI a rectification request citing Article 16, with a link to their current entry in the official register. They also ask for erasure of the false statement if correction is not possible. Meanwhile, they find the likely source: a news story about a different electrician with a similar name. They add a clear registration statement with their registration number to their own website. A month later, OpenAI replies that it has taken steps to prevent the false statement appearing. Search-based answers now cite the electrician's site and the register.

What do people ask about the right to rectification and ChatGPT?

Can a limited company use the GDPR to correct ChatGPT?

Not for data about the company itself. Its founders, directors and staff can use their own rights when the error is about them.

Will OpenAI retrain the model to fix one error?

Do not expect that. OpenAI has said it may not be able to correct inaccuracies in every case, and removal or filtering is the more likely outcome.

Is a disclaimer that ChatGPT can make mistakes enough?

European regulators have said a disclaimer alone does not meet the GDPR's accuracy principle, but how that will be enforced was still being decided in pending complaints.