[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8tfdtcjxYjpFBkgaec0fD2OtMDki5kHgzmLglvCru7s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"ab311f31-2052-4caf-afb3-fd33367f15d6","gdpr-violation-controller-deletes-data-during-active-access-request","cd1bcb29-0d50-4c74-a616-330b0b507667","GDPR Violation: Controller Deletes Data During Active Access Request","The Austrian DSB found that a controller breached GDPR Article 15 rights by allowing project data to be deleted while an active data subject access request (DSAR) was in progress. This effectively obstructed the regulatory investigation and prevented the data subject from exercising their lawful rights. Critically, the controller was held accountable for the processor's deletion actions, reinforcing that controllers cannot delegate away their GDPR obligations. This case highlights how data retention decisions made during live requests can constitute a compliance violation even if the original deletion policy was otherwise lawful. Organizations must implement legal holds and clear DSAR workflows that span both controllers and their processors.","**Immediate Actions:**\n- Implement a formal legal hold procedure that automatically suspends data deletion for any records implicated in an active DSAR or regulatory inquiry.\n- Notify all data processors in writing to pause scheduled deletions whenever a DSAR is received that may involve their systems.\n\n**Long-term Improvements:**\n- Establish a centralized DSAR management system that tracks the status, scope, and associated data assets for every request from receipt to closure.\n- Embed contractual obligations in Data Processing Agreements (DPAs) requiring processors to comply with controller-issued holds and DSAR-related instructions.\n- Conduct annual GDPR training for both controller and processor staff covering data subject rights obligations and the consequences of non-compliance.\n\n**Detection & Audit Measures:**\n- Maintain immutable audit logs of all data deletion events, flagging any deletions that occur while a related DSAR is open for immediate review.\n- Schedule quarterly audits of DSAR handling procedures across all processors to verify adherence to contractual and regulatory obligations.",[12,13,14,15,16,17,18,19,20,21],"GDPR Article 15 (Right of Access)","GDPR Article 17 (Right to Erasure — limitations during active requests)","GDPR Article 24 (Responsibility of the Controller)","GDPR Article 28 (Processor Obligations and DPAs)","GDPR Article 58 (Supervisory Authority Investigative Powers)","NIST SP 800-53 AU-9 (Protection of Audit Information)","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3 (Data Protection)","CIS Control 8 (Audit Log Management)","ISO\u002FIEC 27701 Section 7.3.2 (Handling Data Subject Rights Requests)",{},"published","2026-09-09T10:20:41.377557+00:00","2026-09-09T10:20:41.088+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_DSB-D124.0531\u002F24&diff=52982&oldid=52784","dsb-austria-dsb-d124-0531-24-5215d9","DSB (Austria) - DSB-D124.0531\u002F24",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]