Your AI tool got a customer's details wrong: a GDPR Article 16 correction request sheet for small EU businesses
What you get: a finished correction request sheet for the day a customer, client or job applicant says your AI tool holds something wrong about them: an 11-line request log (deadline, identity, what is wrong, the pause while you check, what you changed, who you told), a search list of 8 places AI tools keep wrong facts, the message to send your AI supplier, and three replies to copy (corrected, more time needed, not changed).
The short answer
Under GDPR Article 16 a person can have inaccurate personal data about them corrected without undue delay, and incomplete data completed, including by adding their own statement. It does not matter that an AI tool wrote the wrong fact: once you keep or use it, the accuracy principle applies to you (Article 5(1)(d): every reasonable step must be taken to erase or rectify inaccurate data without delay). Answer within one month (Article 12(3)), pause use of the disputed data while you check if they ask (Article 18(1)(a)), and tell the suppliers and others you shared it with (Article 19).
The request log (one sheet per request)
| Line | Fill in | Rule |
|---|---|---|
| 1. Received on | [date] · channel (email, form, phone, chat) | Article 12(3): the one-month clock starts here |
| 2. Who is asking | [name] · identity confirmed? Y/N · how | Article 12(6): ask for more only if you have reasonable doubts |
| 3. What they say is wrong | [the exact fact, e.g. wrong job title, wrong amount owed, a complaint they never made] | Article 16, first sentence |
| 4. What they say is missing | [e.g. the refund that was agreed, their side of the dispute] | Article 16, second sentence: complete it, or add their supplementary statement |
| 5. Pause while you check | Restricted from [date] to [date] · Y/N | Article 18(1)(a): if they ask, stop using the data (except storing it) while you verify; tell them before you lift it (Article 18(3)) |
| 6. Where the wrong data sits | [tick the places from the search list below] | Article 5(1)(d): every reasonable step to rectify without delay |
| 7. Your finding | Wrong → corrected / Incomplete → completed / Correct → not changed (evidence: [source]) | Keep the evidence you relied on |
| 8. What you changed | [old value] → [new value], in [system], by [name], on [date] | |
| 9. Who you told | Suppliers and other recipients told on [date]: [list] · person asked for the list? Y/N | Article 19: tell each recipient unless impossible or disproportionate; give the person the list if they ask |
| 10. Stop it coming back | [e.g. fixed the source record the AI reads, removed the old transcript, changed the prompt or template, re-ran the summary] | Otherwise the next AI run repeats the mistake |
| 11. Reply sent | [date] · which reply (A, B or C below) | Within one month, or the extension notice within one month (Article 12(3)) |
Search list: where AI tools keep wrong facts about people
| Place | What to do | Done |
|---|---|---|
| AI call or meeting summaries saved in the CRM or client file | Edit the saved summary; check whether the raw transcript also needs a note or deletion | [ ] |
| CRM fields an AI tool filled in (job title, company, intent, sentiment) | Correct the field and switch off auto-refill for that field if it would overwrite your fix | [ ] |
| Lead, risk or fraud scores | Correct the input data, re-run or override the score, note why; if the score drives a yes/no decision see the Article 22 sheet | [ ] |
| Chatbot conversation history and saved answers | Add a correction note to the stored conversation; fix the knowledge-base page the bot quoted | [ ] |
| The source the AI reads (knowledge base, uploaded files, old emails) | Fix the source first, or the error comes back in the next answer | [ ] |
| AI-written letters, quotes or reports already sent out | Send the person (and the recipient, if any) the corrected version | [ ] |
| Supplier copies and logs | Ask the supplier to help (Article 28(3)(e)) and to apply the correction or deletion where it holds the data | [ ] |
| Marketing audiences and segments built by AI | Move the person to the right segment or remove the wrong label | [ ] |
A disclaimer is not a fix. The EDPB ChatGPT Taskforce report (23 May 2024) said that telling users output may be biased or made up helps with transparency but is not sufficient to comply with the data accuracy principle. Keep the “AI can make mistakes” line on your chatbot, and still correct wrong facts when you are told.
Message to your AI supplier
Subject: Correction request under GDPR Article 16, [our reference]
We have received a correction request from a person whose data you process for us under our agreement. Please (1) tell us where you hold data about [identifier, e.g. email address or customer ID] in [tool name], including logs and stored outputs, (2) apply this correction: [old] → [new], or delete the wrong record if it cannot be edited, and (3) confirm in writing by [date]. Please also tell us whether any stored output will be regenerated from the old data.
Three replies to copy
A. Corrected. Thank you for telling us. We have corrected [the fact] to [the correct fact] in [our customer records / our call notes / our assistant’s saved answers] on [date], and asked [supplier] to do the same. We have also told [recipients]. If you see the old information again, please reply to this email.
B. More time needed. We received your request on [date]. Because [reason, e.g. we need to check records held by two suppliers], we need up to two more months and will reply by [date]. Until then we have stopped using the disputed information except to store it.
C. Not changed. We checked [the fact] against [source, e.g. the signed order of 3 March] and it is accurate, so we have not changed it. We have added your statement to the record so that anyone who reads it sees your view. You can complain to [supervisory authority] and you can go to court if you disagree.
Do this week
- Name one person who handles correction requests and put the request log in a shared folder
- For each AI tool, write down where its outputs about people are saved (use the search list)
- Check whether each tool lets you edit or delete a stored output, and how to ask the supplier if not
- Check your supplier contracts include help with data subject requests (Article 28(3)(e))
- Add the “AI can make mistakes, tell us and we will correct it” line and a contact address to your chatbot and privacy notice
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5(1)(d), 12(3), 12(4), 12(6), 16, 18(1)(a), 18(3), 19 and 28(3)(e)). National rules can add obligations. Checked on 22 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who use AI to write call notes or chase invoices will get “that is not what I said” complaints. Hand them this sheet with their client AI inventory, and stay inside your professional rules.
Keep requests next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once, and keep each closed request log as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then keep this sheet ready. Related: access request sheet · erasure and objection request sheet · Article 22 automated decision sheet · AI data retention schedule.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 5(1)(d), 12, 16, 18, 19, 28(3)(e)
- EDPB, Report of the work undertaken by the ChatGPT Taskforce, 23 May 2024: section 3.4, data accuracy
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.