Topic starter
18/08/2026 2:38 pm
TL;DR: GDPR makes organisations responsible for personal data they store and process, including requests for access and erasure, and Ground Labs argues that the cost of non-compliance can exceed the cost of preparation through fines, legal defence, and reputational damage. The core issue is not the deadline itself but whether data governance, retention, and transparency controls can support ongoing accountability.
Editorial analysis by NHI Mgmt Group, based on content published by Ground Labs: “Post-GDPR – Whats your business-as-usual tool?”.
Key questions
Q: What fails when organisations cannot locate all personal data for a Subject Access Request?
A: The response process fails because completeness depends on data lineage, ownership, and searchability.
Q: When does GDPR become a regulatory accountability problem rather than a privacy policy issue?
A: It becomes an accountability problem as soon as the organisation cannot prove where personal data lives, who can access it, and how deletion or correction is enforced.
Q: Where do organisations most often break erasure obligations in practice?
A: They usually break at copies outside the primary application, especially backups, logs, exports, replicas, and downstream analytics stores.
Practitioner guidance
- Build a personal data inventory Identify where EU citizen data is collected, stored, copied, and processed across systems, including shadow repositories and backups.
- Test Subject Access Request workflows Run end-to-end exercises that trace one person’s records through every business system and verify response completeness and timeliness.
- Extend erasure controls beyond primary applications Confirm that deletion reaches replicas, exports, logs, archives, and downstream analytics stores, with approved exceptions documented.
Bottom line: GDPR makes personal data governance an organisation-wide operational duty, not a narrow legal task for one team.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:22 pm
GDPR compliance is a data governance problem before it is a legal one. The article's core message is that organisations are accountable for the personal data they hold, even when that data spreads across systems and teams. Policies matter only if they can be executed against real data locations, and that makes discovery and retention controls the first line of accountability. Practitioners should treat personal data visibility as a control objective, not an afterthought.
A question worth separating out:
Q: How should security and privacy teams coordinate on GDPR data liability?
A: They should share a single inventory of personal data, a clear ownership model, and a documented response workflow for access and erasure requests. Security controls enforce who can reach the data, while privacy controls define when retention or deletion is required. Without that coordination, the organisation can satisfy neither operational governance nor regulatory evidence.
👉 Read our full editorial: GDPR compliance shifts data liability to every organisation