The DSAR Backlog and the Analytics Vendor

Sequence by legal exposure and irreversibility, not by arrival date. First, stop the clock where lawful: for the 19 overdue requests, issue a written update if an extension is available, explain the reason, and record the date. Second, triage all 63 into high-risk (children, health, financial, complaint-linked), straightforward, and complex; assign two temporary trained reviewers and one quality checker. Do not pause DSAR work for two weeks-the regulator inquiry makes delay more damaging, and the COO's request would convert a backlog into evidence of systemic failure. Third, build a single intake log with identity verification, search scope, and sign-off; use the inquiry to show remediation. Fourth, fix the root cause: self-service portal, retention deletion, and a documented search protocol. Finally, report weekly to the COO and DPO with volumes, overdue count, and closure rate. The judgement is that regulatory response and DSAR remediation share evidence; pausing one undermines the other.

Treat the AI feature as a new processing operation and a likely high-risk processing activity. Immediate actions: suspend external summarization or switch to a local model until review; obtain a data map of transcripts, clickstream, and any special-category data; execute data processing terms with the vendor; identify subprocessors and transfer mechanism; complete a transfer impact assessment; and assess lawful basis and transparency. The absence of a DPA and TIA is not a paperwork gap-it means the transfer has no documented safeguard. The website-only subprocessor list fails diligence and change-notification requirements. Marketing consent cannot be assumed for a new purpose; check whether the AI feature changes the purpose. Retention: 24 months in analytics versus seven years in backups needs a defensible backup exemption and deletion process, not an unexplained inconsistency. Report to the DPO and, if the transfer is ongoing, consider a regulator notification with a remediation timeline. Do not let the COO's pause extend to this work.

Communicate facts, scope, and remediation-not speculation. To the regulator: confirm receipt, appoint a single contact, provide a chronology, the number of overdue DSARs, the cause (intake, search, staffing), the remedial actions already taken, and a dated plan with owners. Do not claim full compliance or blame the vendor. If the AI transfer is confirmed unlawful, disclose it separately with containment steps. To the board: use a one-page dashboard with legal exposure, customer impact, and resourcing decisions needed; avoid legalese that obscures accountability. To customers: only where required or where their data was affected; keep messages consistent with the regulator filing. Preserve documents under a legal hold; do not delete the backlog or the marketing emails. The key judgement is that early, accurate disclosure with a credible plan is more defensible than a delayed perfect account, and that the COO's two-week pause would create a second, avoidable failure.