Topic starter
18/08/2026 2:43 pm
TL;DR: Data subject requests are shifting from simple access lookups to deletion-heavy, cross-platform workflows that must reach cloud, SaaS, collaboration tools, and AI systems, according to BigID. The governing issue is no longer response intent but discovery, scope, and defensible execution across fragmented personal data estates.
Editorial analysis by NHI Mgmt Group, based on content published by BigID: “The DSR Has Changed Under Your Feet: What Privacy Teams Are Actually Up Against”.
By the numbers:
- 36% of consumers had exercised their data subject access rights, up from 28% the year before, according to BigID.
- 46% of consumers aged 25 to 34 had exercised these rights, compared with just 16% of those 65 and older, according to BigID.
- 60% of organizations reported an increase in DSARs year over year, according to BigID.
Key questions
Q: What breaks when data subject requests rely on manual workflows?
A: Manual DSR workflows break when the organisation can no longer guarantee complete search coverage, timely action, and defensible evidence across every system holding personal data.
Q: Why do deletion requests create more risk than access requests?
A: Deletion requests create more risk because they require the organisation to change data state across multiple systems, not just disclose records.
Q: What are the signs that DSR management is failing in practice?
A: DSR management is usually failing when requests take days instead of hours, teams rely on ad hoc spreadsheets, deadlines vary by region, and approvals are not tracked end to end.
Practitioner guidance
- Automate cross-system data discovery Index personal data across structured stores, collaboration tools, SaaS platforms, and AI-related repositories before a request arrives.
- Separate deletion workflows from access workflows Route erasure, correction, and opt-out requests through distinct execution paths because each requires different system actions and proof.
- Add defensible audit trails to every response Capture what was searched, what was found, what was removed, and what remained so the organisation can defend its response later.
Bottom line: Data subject requests have outgrown manual handling because the request surface now spans cloud, SaaS, collaboration data, and AI-related content.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:27 pm
Manual privacy operations are failing because the control boundary no longer matches the data boundary. Privacy teams inherited a model built for structured records and bounded systems, but personal data now moves through cloud collaboration, SaaS, and AI workflows. That creates a governance gap where request intake can be correct while fulfillment is still incomplete. The practical consequence is that defensibility now depends on discovery reach, not ticket handling.
A question worth separating out:
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem. Define who or what can use each dataset, what purpose is allowed, and what runtime restrictions apply. Then review humans, service accounts, and AI agents separately so entitlement scope matches actual behaviour rather than a generic AI policy.
👉 Read our full editorial: Data subject requests are outgrowing manual privacy workflows