Greek DPA Fines Teleperformance €100K for Failing to Honour Data Subject Access Request
Written by AI from the linked story. Not reviewed by an editor. How this works
Service 800 Teleperformance failed to adequately respond to a former employee's data subject access request (DSAR), citing data deletion policies and account deactivation as justifications for withholding emails and personal information. The HDPA ruled this constituted a systemic compliance failure, not a legitimate technical limitation. Organisations must balance routine data deletion practices with the legal obligation to locate and provide personal data upon request. This case illustrates that poor DSAR workflows and inadequate data inventory management can expose organisations to significant regulatory fines even without a traditional cyberattack.
Tactical Insight
Immediate actions
- Establish a formal DSAR intake and fulfilment procedure that assigns clear ownership, tracks deadlines, and documents every step of the response.
- Audit current data deletion and account deactivation policies to ensure they do not inadvertently destroy personal data that may be subject to a pending or foreseeable access request.
Long-term improvements
- Maintain a comprehensive data inventory (Record of Processing Activities) mapping where personal data is stored so it can be reliably located in response to DSARs.
- Implement a legal-hold mechanism that pauses automated deletion policies when a data subject request or dispute is active.
- Train HR, legal, and IT teams annually on GDPR data subject rights obligations, including the interplay between retention schedules and access requests.
Detection and governance measures
- Deploy logging on data access and deletion events so that historical activity can be reconstructed if challenged by a regulator or data subject.
- Conduct periodic mock DSAR exercises to test the organisation's ability to locate, retrieve, and deliver personal data within the statutory 30-day window.