ISS-002Control gapMediumAction planning
Data-subject-request control is overdue and ineffective
This issue has no action plans yet. Create at least one to begin remediation — an issue cannot be closed until every action plan under it is closed.
Description
Control C-067 (Data subject request handling) is overdue for testing and its latest design review flagged an unclear escalation path. No action plans have been created yet — the action-planning SLA for a medium issue has been breached.
Action-plan SLA
Plans required by
12 Feb 2026
Action plans
0No action plans yet. Create one to start remediation. An issue can have multiple action plans, each closing one or more findings or risks.
What this issue addresses
Audit findings
DSR escalation path is undocumented
F-003 · Internal Audit — Privacy Operations Review 2026
Control gaps
Data subject request handling
C-067
Risks mitigated
Data subject rights non-compliance
R-005 · residual
Requirements
GDPR Art. 12(3)GDPR Art. 30