Small survey but still very worrying- adds to anecdotal evidence that organisations still in confusion about "Subject Access Requests" (SAR) nor the extent of personal data in and across the org. Add to that- most organisations cannot access unstructured data and RETRIEVE the relevant data for SARs.
But they have to- end of! From May 25th this year.
Two-thirds of the respondents didn’t know if individuals’ personal data could be purged entirely from their systems. Twenty-two percent were not aware they needed to comply with the GDPR if they captured and maintained data of European Union citizens, since they are based outside the U.S. (Many experts say they do.) Nearly 40% said that personal data at their companies is not protected from misuse and unauthorized access throughout its lifecycle. Sixty-four percent of responding organizations don’t have a Data Protection Officer, as required by GDPR. More than half don’t know if they have explicit consent from individuals for processing of their personal data.
/Passle/5936d4a43d94760a145c92a7/SearchServiceImages/2026-10-07-15-47-10-738-6ac6697ea94b9e84e53c38fc.jpg)
/Passle/5936d4a43d94760a145c92a7/SearchServiceImages/2026-10-05-10-49-57-927-6ac380d5147a7b8e1ace985b.jpg)
/Passle/5936d4a43d94760a145c92a7/SearchServiceImages/2026-09-23-14-13-13-321-6ab3de7902670829c849ef1a.jpg)
/Passle/5936d4a43d94760a145c92a7/SearchServiceImages/2026-09-04-12-26-17-999-6a9ab8e94804626b99cd417a.jpg)