For a rectification request or an objection to processing, the same deadline applies as for a data access or deletion request: one month from receipt. The GDPR allows you to extend this deadline by up to two months if the request is complex or if you receive multiple requests at the same time, but you must inform the data subject within the first month that you are extending the deadline and why.
What often goes wrong in practice is not the deadline itself but the moment when it starts running. With rectification and objection, there is also a substantive question that does not arise with a data access request: is the request justified? That takes time to assess, and this assessment time falls within the same month.
What the clock actually measures
The month starts when the request reaches you, not when you recognize it as such. An email to customer service saying "this is wrong, change this" is already a rectification request, even if no one has recorded it as such. The same applies to an objection: a customer who writes "I no longer want you to use my data for this purpose" does not need to use the word objection. When supervisory authorities assess whether a request has been handled properly, they look at the moment of receipt, not the moment of recognition. If you do not document this distinction, you often lose days before the request is on the agenda.
Rectification: often quick, but with a condition
Correcting an address or telephone number is usually straightforward and quick to process. It becomes more difficult when the data subject claims that an assessment, note or file entry is incorrect. This is no longer about a factual error, but about a substantive judgment, and that requires coordination with the person who made the note. This coordination must happen within the month, and this only works if the request reaches the right person immediately instead of sitting with whoever happened to open the email.
Objection: assess, do not automatically grant
An objection to processing does not have to be automatically granted. The Regulation indicates that an organization can weigh whether there are compelling legitimate grounds to continue processing, for example in the context of an ongoing contract or a legal obligation. This assessment must be communicated with reasons to the data subject within the same deadline. Many organizations underestimate how much time this reasoning takes, because they forget that saying "no" to an objection must be justified just as thoroughly as saying "yes".
Where the deadline gets stuck in practice
In most cases, the deadline does not get stuck on the content, but at three recognizable points. The first is recognition: the request is not recognized as such and remains in an inbox. The second is verification: before you modify data or stop processing, you must be reasonably sure that the person making the request is actually the data subject, and this check takes time that is not always planned for. The third is coordination within the organization itself: an HR file or a customer assessment is often not held by one person, and without a fixed point of contact the search takes longer than the decision. A knowledge base in which each type of request is explained separately helps to make this distinction beforehand instead of only at the first request.
What counts as on time
Responding in time means that the data subject receives a substantive answer within the deadline, a reasoned refusal, or a message that the deadline is being extended. A bare acknowledgment of receipt does not count as handling. Precisely because correction and objection often require substantive consideration more than an access request, it is advisable to determine early in the month who within the organization makes that assessment and on the basis of what information. The frequently asked questions about data subject requests provide a short answer per situation on what is and is not covered by this deadline.
Whether a specific request is justified, and how you substantiate a refusal, is something that differs per situation and for which you should consult a lawyer or the Dutch Data Protection Authority in case of doubt. What gdpria.eu does do is monitor the deadline itself: as soon as a request is registered, the deadline runs automatically, including the moment when an extension must be announced. On how it works is where that deadline logic comes from and how it is tracked.
Would you like to see for your own business what such a request looks like in practice and where you currently stand? The free quick-scan on gdpria.eu provides a first indication in a few questions, and with a business account you record the handling of each request with the associated deadline.