Notifications
Clear all
Topic starter
08/06/2026 5:08 pm
TL;DR: GDPR compliance is shifting from manual legal and IT workflows to identity-based controls for consent, access, erasure, logging, and lifecycle management, according to Okta. The core issue is not policy intent but operational scale: compliance fails when identity data, downstream app permissions, and audit evidence remain fragmented across systems.
NHIMG editorial — based on content published by Okta: Starting Your General Data Protection Regulation (GDPR) Journey with Okta
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should organisations operationalize GDPR access and erasure requests through identity systems?
A: Treat them as lifecycle workflows, not manual tickets.
Q: Why do manual GDPR processes break down as organisations scale?
A: Manual processes break down because the number of requests, apps, and data stores grows faster than the team’s ability to reconcile them.
Q: How do you know if consent management is actually working?
A: Consent management is working when the current purpose, scope, and timestamp are available in one authoritative record and downstream applications honor those attributes consistently.
Practitioner guidance
- Model GDPR rights as lifecycle workflows Map access, rectification, portability, and erasure to governed provisioning and deprovisioning steps, with ownership and approval paths defined before requests arrive.
- Store consent with the authoritative identity record Keep consent purpose, scope, and timestamp as identity attributes that downstream apps can read consistently.
- Centralize access evidence and login history Aggregate system logs, access reports, and suspicious activity signals into one evidentiary trail that supports breach notification and subject access requests.
What's in the full article
Okta's full article covers the operational detail this post intentionally leaves for the source:
- The specific mapping between GDPR articles and Okta identity functions for consent, access, and erasure workflows.
- Examples of how Universal Directory is used to store consent and profile attributes for downstream enforcement.
- The logging and reporting approach used to support breach investigation and supervisory authority notification.
- The staged compliance model showing how organisations move from manual handling to platform-based governance.
👉 Read Okta's analysis of GDPR compliance through customer identity →
GDPR and customer identity: where compliance breaks down?
Explore further
08/06/2026 7:09 pm
GDPR exposes the same governance weakness that NHI programmes face: identity data is often distributed faster than it can be governed. The article shows that compliance breaks when consent, profile state, and downstream permissions are scattered across systems that do not share a single operating model. That is the same structural problem identity teams see with service accounts and tokens. The practitioner conclusion is that governance has to start with authoritative identity state, not after-the-fact reporting.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why identity evidence is often incomplete before an investigation even begins.
A question worth separating out:
Q: Who is accountable when GDPR evidence cannot be reconstructed after an incident?
A: Accountability sits with the organisation that failed to maintain a usable audit trail. If logs, access records, and application reports are missing or incomplete, the privacy and security functions cannot prove what happened or support notification obligations. That is a governance failure, not just an incident-response gap.
👉 Read our full editorial: GDPR compliance is becoming an identity governance problem
