R-005Data protectionOpenOutside appetite
Data subject rights non-compliance
Description
Failure to handle data subject access, erasure, and portability requests within statutory deadlines.
Rating
INHERENT
MediumRESIDUAL
Mediumvs last review
Remediation
Mitigation is attributed per action plan and issue — a risk may need several plans across issues before it is fully mitigated.
Issues
Data-subject-request control is overdue and ineffective
ISS-002