Why do organisations struggle to stay compliant with GDPR when processing personal data across multiple systems?

Why This Matters for Security Teams

GDPR compliance becomes difficult once personal data moves beyond one application and into a chain of databases, SaaS platforms, logs, backups, analytics jobs, and vendor workflows. The legal duty is not limited to storage. It spans purpose limitation, minimisation, retention, deletion, access control, and the ability to show what happened to each record. That is why teams often fail at the operational layer, even when the privacy notice looks complete. Current guidance from the EU General Data Protection Regulation (GDPR) makes clear that accountability is continuous, not point-in-time.

In practice, the hardest part is proving control across disconnected systems. Security teams may know where data originates, but not where it is copied, transformed, cached, or retained after the original business purpose ends. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts in environments where identity sprawl is already a common failure mode, which mirrors the same governance gap seen in data flows. See Ultimate Guide to NHIs — Key Research and Survey Results and the Regulatory and Audit Perspectives section for the operational pattern behind this risk. In practice, many security teams encounter GDPR issues only after data has already been replicated into systems nobody clearly owns.

How It Works in Practice

Effective GDPR control depends on mapping the full data lifecycle, then binding technical controls to each stage. That means identifying where personal data is collected, where it is transmitted, which systems process it, where it is stored, and how it is deleted or anonymised. For security teams, this is not only a privacy task. It is an identity, access, and control-mapping exercise. NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls and NIST Cybersecurity Framework 2.0 are useful anchors because they translate governance into measurable controls.

• Classify personal data by system, purpose, and legal basis before it spreads into downstream tooling.
• Assign a business owner and a technical owner for each processing activity so accountability is not ambiguous.
• Enforce retention rules in the systems that actually hold data, including replicas, caches, exports, and backups.
• Track vendor and internal transfers so subject access, deletion, and correction requests can be executed end to end.
• Log access and changes in a way that supports audit evidence, incident review, and regulatory response.

This is also where NHIMG guidance on lifecycle discipline is practical. The Lifecycle Processes for Managing NHIs section illustrates the same operational truth: if issuance, rotation, and revocation are not automated, governance breaks under scale. Personal data processing fails for the same reason when deletion and retention are left to manual follow-up. These controls tend to break down when legacy systems, shadow copies, and vendor-managed pipelines store data outside the primary privacy workflow because deletion and audit evidence become incomplete.

Common Variations and Edge Cases

Tighter privacy control often increases operational overhead, requiring organisations to balance deletion speed and auditability against system complexity and business continuity. Best practice is evolving, especially where data is embedded in machine learning pipelines, event streaming, or shared analytics platforms. There is no universal standard for how every downstream copy must be instrumented, so organisations should document local decisions clearly and apply them consistently. The GDPR page itself is useful for confirming the legal baseline, but implementation still depends on architecture.

One common edge case is mixed-purpose data. A record may be needed for customer support, billing, fraud detection, and legal hold, but each purpose can imply a different retention rule. Another is backup and disaster recovery: deletion requests do not always mean instant removal from immutable backups, but they do require a defensible retention and restoration process. For teams building evidence trails, the Top 10 NHI Issues research is a useful reminder that governance gaps often emerge where ownership is fragmented and controls are uneven. Organisations should treat privacy exceptions as documented risk decisions, not informal workarounds.

Related resources from NHI Mgmt Group

• Why do data inventories become essential when organisations manage personal and sensitive data across multiple systems?
• Why do personal data handling rules create governance risk when organisations expand across borders?
• How should organisations implement data transparency across cloud, SaaS, and legacy systems?
• How do organisations keep AI data access compliant across multiple platforms?