August 2026 The Data Protection Commission (DPC) 2025 annual report and case studies show that data subject rights compliance requires more than meeting the one-month deadline, it requires robust governance, clear decision-making and defensible processes. Introduction Data subject access requests continue to present one of the most significant operational and compliance challenges for organisations. The DPC’s 2025 Annual Report (Annual Report) states that by the end of 2025,

20 March 2026 Intro Under Article 17 GDPR, individuals have the right to request erasure of their data (right to be forgotten). This right is not absolute, for example the data controller needs to retain the data to comply with a legal obligation or the data controller requires the data for the purpose of a legal claim. The European Data Protection Board (EDPB) selected the topic ‘Implementation of the right to erasure by controllers’ for its 2025 Coordinated Enforcement Act