You corrected or deleted someone's data, but your AI tools already shared it? A GDPR Article 19 recipient notification sheet for small businesses
What you get: a finished recipient notification sheet in two tabs: a recipients list (who received which personal data from each AI tool, and how to send them a change) and a notifications log with one row per recipient per change, a column for the "impossible or disproportionate effort" reason, a status formula, the reply to "who did you share my data with?" and two made-up example rows.
Short answer: fixing a wrong record, deleting it or restricting it in your own system is only half the job. If the data were already sent on, for example to an AI chatbot or transcription supplier, a CRM, a mailing tool or a partner, Article 19 GDPR says you must pass the correction, erasure or restriction on to each of them, unless that is impossible or involves disproportionate effort, and tell the person who they are if they ask.
Step 1: when Article 19 is triggered
- You carried out a rectification under Article 16 (for example a wrong AI-generated note in a customer file), an erasure under Article 17(1) or a restriction under Article 18. Use your rectification, erasure or restriction sheet for the request itself; this sheet starts once the change is made.
- The personal data had been disclosed to a recipient. Article 4(9) covers anyone the data are disclosed to, "whether a third party or not", so check your AI suppliers as well as other businesses. Public authorities receiving data in a particular inquiry are not recipients.
- Data you made public (for example on a website) are a separate duty: under Article 17(2) you take reasonable steps to inform other controllers processing it about the erasure request. Note it in the same log, but it is a different test.
Step 2: tab 1, the recipients list (fill once, update when you add a tool)
| Column | What to write | Source |
|---|---|---|
| A. Recipient | Name of the supplier or business (AI chatbot supplier, meeting transcription tool, CRM, email marketing tool, payroll provider, accountant, partner agency) | Art. 4(9) |
| B. Role | processor (works for you under a processor agreement) or controller (decides for itself, such as an accountant or a partner you sell leads to) | Art. 4(7), 4(8), 28 |
| C. Data sent | Which personal data go there: contact details, chat transcripts, call recordings, AI summaries, scores | Art. 30(1)(d) |
| D. How a change reaches them | Sync (the change flows automatically), admin console (you delete or edit it there yourself), API, or support or privacy email address | Our working practice |
| E. Contact | The address or menu path to use, so the next notification takes minutes | Our working practice |
Most of this is already in your Article 30 records (categories of recipients) and your privacy notice (Articles 13(1)(e) and 14(1)(e)); copy it across and name each recipient.
Step 3: tab 2, the notifications log (one row per recipient per change)
| Column | What to write | Source |
|---|---|---|
| A. Request ref | The row number or ID from your rectification, erasure or restriction sheet | Art. 16, 17(1), 18 |
| B. Change type | Rectification, Erasure or Restriction (drop-down list) | Art. 19 |
| C. Request received | Date the person's request arrived | Art. 12(3) |
| D. Reply due | =EDATE(C2,1), the one-month limit for telling the person what action you took (extendable by two months for complex or numerous requests if you tell them within the first month) | Art. 12(3) |
| E. Recipient | From tab 1, column A. One recipient per row; a change sent to four tools is four rows | Art. 19 |
| F. What you told them | The corrected value, "please erase all data on this person" or "please restrict: store only, do not use" (Art. 18(2)), with the minimum identifiers needed | Art. 19; Art. 5(1)(c) |
| G. Notified on | Date and method (console, API, email). Leave empty until done | Art. 5(2) |
| H. Confirmation | Ticket number or reply from the recipient. A processor should help you here under its agreement (Art. 28(3)(e)) | Art. 28(3) |
| I. Not notified: reason | Only if notifying proved impossible (for example the recipient no longer exists) or involves disproportionate effort. Write the concrete facts, not just the words | Art. 19 |
| J. Status | =IF(G2<>"","Notified",IF(I2<>"","Not notified: reason recorded",IF(TODAY()>D2-7,"Finish before reply due","Open"))). The 7-day warning is our own working rule, not a legal one | Art. 12(3) |
| K. Person asked who received it? | Yes or No, and the date you sent the list of recipients from column E (names, not just categories, unless naming them is impossible) | Art. 19; Art. 15(1)(c); C-154/21 |
Put the column letters in row 1 and the first change in row 2; the formulas assume that layout. Filter column J for "Finish before reply due" every Monday, and only send the person your final reply once every row for their request is Notified or has a reason in column I.
Step 4: AI tools need a closer look
- Check whether a correction in your main system actually reaches copies kept elsewhere: chatbot conversation history, call transcripts and AI summaries, exports a colleague made, and a supplier's own logs. A sync that only covers some fields means extra rows.
- For a restriction, ask the recipient to store the data but not use it, which includes not feeding it into AI features or automations while the restriction lasts (Art. 18(2)).
- If a supplier keeps prompts or files for its own purposes, it may be acting as a controller for that part; that is a recipient in its own right and gets its own row.
- Keep the message short and send only what the recipient needs to find and change the record.
Two example rows (made-up businesses, for illustration only)
Example 1, a small physiotherapy practice, rectification of a wrong AI-written visit summary: A. R-07 · B. Rectification · C. 03/11/2026 · D. 03/12/2026 · E. "Example transcription tool" (processor) · F. corrected summary text for one visit, patient ID only · G. 05/11/2026 via admin console, old summary deleted · H. not needed, change made directly · I. empty · J. Notified · K. Yes, list of two recipients sent 06/11/2026.
Example 2, a small web agency, erasure of a former lead: A. E-12 · B. Erasure · C. 10/11/2026 · D. 10/12/2026 · E. "Example lead-scoring CRM" (processor) and "Example partner agency" (controller), two rows · F. "please erase all data on this contact" · G. CRM 11/11/2026 by API; partner 12/11/2026 by email · H. CRM deletion log; partner confirmed 14/11/2026 · I. empty · J. Notified · K. No.
Do this week
- Fill tab 1 for every AI tool and every business you send personal data to
- For each recipient, find out how a correction or deletion reaches them and note it in column D
- Add "check Article 19 recipients" as the last step on your rectification, erasure and restriction sheets
- Check that your processor agreements cover help with data subject requests
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4, 5, 12, 15, 16, 17, 18, 19, 28 and 30 and Recital 66, as published on gdpr-info.eu) and to the judgment of the Court of Justice of 12 January 2023 in case C-154/21, Österreichische Post. Article 19 does not define "disproportionate effort" or set its own number of days; the 7-day warning, finishing notifications within the Article 12(3) month and the layout are our own working rules. National authorities and courts may take a stricter view, so check your data protection authority's guidance. Example rows are made up for illustration and do not describe any real business or supplier. Checked on 25 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
You are often both: a recipient of your clients' customer and staff data, and a business that passes data on to payroll and software suppliers. Ask clients to send you corrections and deletions in writing, keep a row per change, and hand them this sheet with the client AI inventory so their recipients list is complete. Stay inside your professional rules and refer legal questions on.
Keep recipients next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once with the recipients it sends data to, and attach each notification row as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: rectification sheet · erasure and objection sheet · Article 18 restriction sheet · access request sheet · processor agreement check
Sources
- Article 19 GDPR, Notification obligation regarding rectification or erasure of personal data or restriction of processing (with Article 4, Definitions, Article 12, Article 15, Article 17, Article 18 and Recital 66); official text: Regulation (EU) 2016/679
- Court of Justice, judgment of 12 January 2023, C-154/21, Österreichische Post (identity of recipients under Article 15(1)(c))
- EDPB Guidelines 01/2022 on data subject rights, right of access
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.