Bulgarian Court Rules GDPR Article 15 Violated by Incomplete Data Access Response
A Bulgarian non-banking financial institution was found to have violated GDPR Article 15 by providing only an extract of records rather than full copies of documents containing a data subject's personal data. The court clarified that the right of access requires complete document copies — including loan agreements and payment records — not summaries or partial responses. This case highlights how organizations often underestimate the scope of data subject access requests (DSARs), treating them as administrative formalities rather than substantive legal obligations. Failure to comply fully with Article 15 exposes organizations to regulatory enforcement, reputational damage, and costly litigation.
Tactical Insight
Immediate actions
- Audit all existing DSAR response procedures to ensure full document copies are provided rather than extracts or summaries.
- Train staff handling DSARs on the precise legal requirements of GDPR Article 15, including permitted restrictions under Article 23.
Process improvements
- Establish a documented DSAR workflow that maps personal data across all systems (CRM, loan platforms, payment records) to ensure complete responses.
- Define and document the criteria under which Article 23 restrictions may legitimately be applied, and require legal sign-off before invoking them.
- Set internal SLA timers and quality-check gates to review DSAR responses before dispatch.
Long-term improvements
- Implement a dedicated Data Subject Rights Management platform to systematically locate, compile, and deliver all relevant personal data in response to access requests.
- Conduct annual GDPR compliance reviews with a focus on data subject rights obligations across all business units.