[LT-06]
The DSAR Volume Problem
GDPR Article 12 requires organizations to respond to Data Subject Access Requests within one month, with a possible two-month extension for complex requests. The one-month clock is absolute — no grace period, no good-faith exception. Non-compliance with response timeframes is independently sanctionable regardless of the underlying data protection practices.
Major DPA enforcement actions in 2024 — the Irish DPC's €310 million fine against LinkedIn for behavioral ...