Notification of Data Changes to Third Parties
Plain English Translation
Under GDPR Article 19, organizations must notify third parties when personal data they previously shared is rectified, erased, or restricted. Whenever a data subject exercises their rights to update or delete their information, the controller must reach out to each recipient to whom the data was disclosed to ensure they also apply the changes. The only exceptions are if notifying these recipients is impossible or involves disproportionate effort. Furthermore, the organization must inform the data subject about these recipients if requested.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Identify and document all third-party recipients, processors, and vendors with whom personal data is shared.
- Create a standard operating procedure for emailing or ticketing these vendors whenever a rectification or erasure request is completed.
Required Actions (scaleup)
- Implement a centralized data subject request log to track downstream notifications.
- Use webhooks or API integrations to automatically notify primary processors of data changes.
Required Actions (enterprise)
- Integrate comprehensive data mapping and consent management platforms to automatically trigger downstream deletion or rectification requests.
- Audit processors regularly to ensure they are honoring Article 19 notifications without undue delay.
Evidence Required
GDPR Article 19 establishes the notification obligation regarding the rectification, erasure, or restriction of personal data. It applies whenever an organization fulfills a data subject right request under Articles 16, 17, or 18, requiring the controller to inform all third-party recipients of those data changes.
Yes, you must communicate any data rectification to each recipient to whom the personal data has been disclosed. The only exception is if this notification proves impossible or involves disproportionate effort.
Yes, processors are considered recipients under GDPR. The notification obligation to recipients applies to any entity, whether a third-party controller or a processor, that has received the affected personal data.
Proving impossibility or disproportionate effort is a high bar, typically applying when tracking the recipients is technologically unfeasible or when the data was widely publicized prior to the request. The organization must document its justification clearly if relying on this exception.
You should use a data subject request log or an authorized disclosure log to record the exact date, method, and recipient of each notification. Maintaining this audit trail is essential to demonstrate accountability and compliance with the GDPR notification obligation to recipients.
Yes, under Article 19, the controller must inform the data subject about the specific recipients of their data, but only if the data subject explicitly requests this information.
Article 17 gives the data subject the right to have their data erased by the controller, while Article 19 dictates that the controller must subsequently inform downstream recipients about that erasure. They work together to ensure data is removed globally across the vendor ecosystem.
You must rely on an accurate data inventory and vendor map to identify every system and recipient that received the data. Once identified, organizations should systematically issue notifications to each vendor's designated privacy contact to process the rectification, erasure, or restriction.
While Article 19 does not specify an exact timeframe, notifications should be sent without undue delay as part of fulfilling the overarching data subject request, which generally has a one-month statutory deadline.
Security teams should implement comprehensive vendor inventories, centralized privacy request management platforms, and automated workflows. Utilizing a data subject request log ensures tracking of notifications to third parties after a right to erasure request or data rectification.
Article 19 is easiest to evidence when you can show a consistent trail from the request to the downstream notifications. Tools like WatchDog Security's Compliance Center can centralize evidence (tickets, emails, vendor confirmations) and map it to this control so auditors can verify who was notified, when, and by what method.
The biggest operational risk is missing a recipient because the vendor list is incomplete or outdated. Tools like WatchDog Security's Vendor Risk Management can maintain a living vendor catalog (including privacy/security contacts and risk tiering) so teams can route rectification, erasure, and restriction notifications to the right recipients and keep an auditable record of follow-up.
"The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it."
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-23 | WatchDog Security GRC Team | Initial publication |
