Data subject rights depend on finding the data
Someone can ask what you hold about them, and you have to be able to answer.
That is straightforward if you know where personal data lives and hard if it is scattered across systems, exports, backups and spreadsheets nobody catalogued. Most of the difficulty organisations have with subject access is not legal, it is that they genuinely cannot locate everything. The rights are only as practical as the data map.
More on Privacy engineering
- Anonymisation is about re-identification riskThe name was the easy part
- Differential privacy limits one person's influenceOne person cannot move the needle
- Consent interfaces can undermine genuine choiceBoth answers, very different distances
- Purpose limitation prevents silent mission creepThe pipe was laid for one thing
- Privacy by design moves decisions earlierA line on the plan, or a hole in the wall
- A privacy notice does not create permissionTelling is not asking