GDPR Violation: Controller Deletes Data During Active Access Request
Written by AI from the linked story. Not reviewed by an editor. How this works
The Austrian DSB found that a controller breached GDPR Article 15 rights by allowing project data to be deleted while an active data subject access request (DSAR) was in progress. This effectively obstructed the regulatory investigation and prevented the data subject from exercising their lawful rights. Critically, the controller was held accountable for the processor's deletion actions, reinforcing that controllers cannot delegate away their GDPR obligations. This case highlights how data retention decisions made during live requests can constitute a compliance violation even if the original deletion policy was otherwise lawful. Organizations must implement legal holds and clear DSAR workflows that span both controllers and their processors.
Tactical Insight
Immediate Actions
- Implement a formal legal hold procedure that automatically suspends data deletion for any records implicated in an active DSAR or regulatory inquiry.
- Notify all data processors in writing to pause scheduled deletions whenever a DSAR is received that may involve their systems.
Long-term Improvements
- Establish a centralized DSAR management system that tracks the status, scope, and associated data assets for every request from receipt to closure.
- Embed contractual obligations in Data Processing Agreements (DPAs) requiring processors to comply with controller-issued holds and DSAR-related instructions.
- Conduct annual GDPR training for both controller and processor staff covering data subject rights obligations and the consequences of non-compliance.
Detection & Audit Measures
- Maintain immutable audit logs of all data deletion events, flagging any deletions that occur while a related DSAR is open for immediate review.
- Schedule quarterly audits of DSAR handling procedures across all processors to verify adherence to contractual and regulatory obligations.