[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fimG0IcHoDmkfgx48IIIjMb7lDxz6AThNg9VYse9Wytw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"1e7c2371-4d79-4074-ab46-c26231d0437d","google-ordered-to-provide-complete-data-copy-after-incomplete-gdpr-access-request","9801f214-2dde-4372-bd2c-dfa93b063705","Google Ordered to Provide Complete Data Copy After Incomplete GDPR Access Request","Google failed to fulfill a GDPR Article 15 data subject access request (DSAR) in its entirety, omitting personal data processed through cookies and third-party tracking pixels such as Facebook Pixel. This case highlights that organizations cannot selectively disclose only the data held in primary systems while ignoring data collected through behavioral tracking and third-party integrations. Incomplete DSARs are not merely a compliance oversight — they actively undermine individuals' rights to transparency and control over their personal data. Regulators are increasingly scrutinizing the completeness of data disclosures, and organizations that rely on self-service download portals must ensure those portals capture all personal data across every processing activity.","**Immediate actions:**\n- Audit all existing DSAR fulfillment processes to ensure they capture data from every source, including cookies, pixels, and third-party integrations.\n- Establish a centralized personal data inventory (Record of Processing Activities) that maps all data flows, including tracking technologies.\n\n**Long-term improvements:**\n- Implement a formal DSAR workflow with cross-functional reviews (legal, engineering, privacy) to validate completeness before responding.\n- Conduct periodic privacy impact assessments (PIAs\u002FDPIAs) to identify new data sources that must be included in future access requests.\n- Invest in data discovery tooling capable of locating personal data across structured and unstructured sources, including third-party trackers.\n\n**Governance & compliance measures:**\n- Assign a Data Protection Officer (DPO) or privacy lead to own and review DSAR response quality before submission.\n- Train engineering and product teams to flag any new third-party data processing integrations to the privacy team for DSAR inclusion.",[12,13,14,15,16,17,18,19],"GDPR Article 15 (Right of Access)","GDPR Article 30 (Records of Processing Activities)","GDPR Article 37-39 (Data Protection Officer)","NIST Privacy Framework PR.DS-P1","NIST SP 800-53 IP-1 (Individual Access)","CIS Control 3: Data Protection","ISO\u002FIEC 27701:2019 Section 7.3 (Rights of Data Subjects)","ITIL Service Design – Information Security Management",{},"published","2026-10-09T12:21:27.062539+00:00","2026-10-09T12:21:26.776+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=DSB_(Austria)_-_2025-0.626.844&diff=53353&oldid=53283","dsb-austria-2025-0-626-844-5f6918","DSB (Austria) - 2025-0.626.844",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[43,47],{"slug":44,"name":45,"problem":46},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":48,"name":49,"problem":50},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]