[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$futUKV6pM_xL6Q8EkzPAURmSO-oXmd5Tr0M6knJl02YM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"a466730b-0c85-4819-abd5-a5929a2d356d","greek-dpa-fines-teleperformance-100k-for-failing-to-honour-data-subject-access-request","f4e98b3e-069f-4a5e-8f5d-4f9e1b9405a9","Greek DPA Fines Teleperformance €100K for Failing to Honour Data Subject Access Request","Service 800 Teleperformance failed to adequately respond to a former employee's data subject access request (DSAR), citing data deletion policies and account deactivation as justifications for withholding emails and personal information. The HDPA ruled this constituted a systemic compliance failure, not a legitimate technical limitation. Organisations must balance routine data deletion practices with the legal obligation to locate and provide personal data upon request. This case illustrates that poor DSAR workflows and inadequate data inventory management can expose organisations to significant regulatory fines even without a traditional cyberattack.","**Immediate actions:**\n- Establish a formal DSAR intake and fulfilment procedure that assigns clear ownership, tracks deadlines, and documents every step of the response.\n- Audit current data deletion and account deactivation policies to ensure they do not inadvertently destroy personal data that may be subject to a pending or foreseeable access request.\n\n**Long-term improvements:**\n- Maintain a comprehensive data inventory (Record of Processing Activities) mapping where personal data is stored so it can be reliably located in response to DSARs.\n- Implement a legal-hold mechanism that pauses automated deletion policies when a data subject request or dispute is active.\n- Train HR, legal, and IT teams annually on GDPR data subject rights obligations, including the interplay between retention schedules and access requests.\n\n**Detection and governance measures:**\n- Deploy logging on data access and deletion events so that historical activity can be reconstructed if challenged by a regulator or data subject.\n- Conduct periodic mock DSAR exercises to test the organisation's ability to locate, retrieve, and deliver personal data within the statutory 30-day window.",[12,13,14,15,16,17,18],"GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"GDPR Article 32":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires appropriate technical and organisational measures to ensure data can be accessed and managed lawfully; the failure to retrieve personal data in response to a DSAR reflects a gap in exactly these organisational measures.","The systemic process failure in handling the DSAR is analogous to an unresolved procedural flaw; SI-2's principle of identifying and correcting flaws in organisational processes would have prompted remediation of the broken DSAR workflow.","Staff handling DSARs lacked demonstrated competence in fulfilling data subject rights obligations, and Clause 7.2 requires organisations to ensure personnel are trained and competent for roles with information security and compliance implications.","Receiving a DSAR from a former employee should trigger a defined response procedure; the absence of such a procedure mirrors the lack of an incident response plan, leading to an ad-hoc and ultimately non-compliant outcome.","Employees and managers responsible for data subject requests were evidently unaware of their legal obligations, and structured awareness training covering privacy and compliance would have prevented this gap.","While primarily about technical flaws, the underlying principle of maintaining awareness and control over information assets directly applies to knowing where personal data resides so it can be surfaced on request.","Proper identity lifecycle management—including retention of data associated with former employee accounts—would have ensured personal data remained accessible for legitimate legal requests even after account deactivation.","published","2026-11-03T15:20:23.381611+00:00","2026-11-03T15:20:23.357+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_19\u002F2026&diff=53596&oldid=0","hdpa-greece-19-2026-760dcc","HDPA (Greece) - 19\u002F2026",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[49],{"slug":50,"name":51,"problem":52},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]