August 2026 The Data Protection Commission (DPC) 2025 annual report and case studies show that data subject rights compliance requires more than meeting the one-month deadline, it requires robust governance, clear decision-making and defensible processes. Introduction Data subject access requests continue to present one of the most significant operational and compliance challenges for organisations. The DPC’s 2025 Annual Report (Annual Report) states that by the end of 2025,

June 2026 'We're too small', 'we don't charge EU users', 'our vendor handles it': why these assumptions fail Intro Article 27 GDPR requires organisations without an EU establishment that offer goods or services to individuals in the EU, or monitor their behaviour, to appoint an EU Data Representative ('EU Data Rep.'). In our work with US companies, the obligation is rarely ignored deliberately. More often, it is missed because of a handful of persistent myths. Here are the fi