What is the fourth principle of the GDPR?

The Fourth Principle of the GDPR: Accuracy and Timely Rectification

The General Data Protection Regulation (GDPR) is built on a foundation of seven core principles designed to protect individuals' personal data. Among these, the fourth principle emphasizes accuracy and the importance of keeping personal information up to date.

Every organization handling personal data must take reasonable steps to ensure its accuracy and, when necessary, correct or erase inaccurate information without delay. This is especially critical when that data is being used for law enforcement purposes, where errors can have serious consequences. But the principle applies broadly—whether a company is managing customer records or a public body is processing citizen data.

This isn’t just about fixing mistakes after they’re found. Proactive measures matter. Organizations should implement processes to verify data at collection and update it regularly, especially if it’s used to make decisions that affect individuals. For example, if someone’s address or employment status changes, holding outdated information could lead to incorrect profiling or unfair treatment.

The principle also reflects a broader shift in data protection: it’s not enough to collect data lawfully—you must also maintain its integrity over time. This means building systems that allow for quick responses to data subject requests, such as corrections under the "right to rectification."

In practice, compliance requires both technical and organizational efforts—regular data audits, clear protocols for updates, and employee training. With data accuracy at the heart of trust, this principle reinforces the GDPR’s goal: protecting individuals while enabling responsible data use.