Notification obligation
The notification obligation is a controller’s responsibility: If a company corrects or erases data or restricts its processing based on a data subject’s whish, it needs to tell all other recipients to whom the data has been disclosed about this correction, erasure or restriction. Furthermore, consumers can request what recipients the company has informed.
Article 19 GDPR (Notification obligation regarding rectification or erasure of personal data or restriction of processing)
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
Source: Regulation (EU) 2016/679 (see also recital 66)
