The Access Request That Crossed a Border
A SaaS company headquartered in the EU receives an access request from a customer's employee (a data subject) on day 1. The company is a processor for the customer, but also a controller for the employee's account and support-ticket data. The employee's data sits in three places: (a) the customer's tenant (controller: the customer), (b) the SaaS company's support system (controller: the SaaS company), and (c) a US-based sub-processor used for crash analytics (controller: the customer, processor: the SaaS company). The statutory deadline is one month. On day 12, the company discovers the crash-analytics sub-processor stores data in a region with no adequacy decision and no standard contractual clauses on file for this data flow. The employee has also asked for "everything you have about me, including internal notes."
1. Map each of the three data locations to the correct role and the correct response obligation, and identify where the company must not simply answer directly.
Read the worked answer
(a) Customer tenant - company is processor. The company must not answer the data subject directly on this data. It should forward the request to the customer (the controller) and assist. Answering directly risks disclosing data the customer controls and stepping outside the processing agreement. The clock still runs, so log the forward date.
(b) Support system - company is controller. The company answers directly. This includes internal notes to the extent they are the data subject's personal data. Internal notes that are the author's own opinions about the employee are generally the employee's personal data and should be disclosed (with third-party redaction where needed). Notes that are purely internal process commentary with no personal data need not be. The safe approach: disclose, redact third parties, and document the redaction rationale.
(c) Crash analytics sub-processor - company is processor, customer is controller. Again, the company does not answer directly; it must obtain the data from the sub-processor and pass it to the customer, or have the sub-processor respond through the customer. The company is responsible for the sub-processor's performance under the processing agreement.
The trap is treating "one request" as "one answer." It is three obligations with two different controllers.
2. The cross-border gap surfaces on day 12. What are the immediate obligations, and how does this interact with the one-month deadline?
Read the worked answer
Two separate tracks, and they must not be conflated.
Track 1 - the access request. The transfer gap does not pause the deadline. The company must still respond within one month (extendable by two months for complexity, with notice). For location (c), the company should obtain the data and route it through the customer. If the sub-processor cannot produce it in time, the company notifies the data subject of the extension and reason - it does not simply miss the deadline.
Track 2 - the unlawful transfer. The absence of an adequacy decision and of SCCs means the flow has been operating without a valid transfer mechanism. Immediate actions: suspend or restrict the flow, notify the customer (controller for that data) so they can assess their own obligations, put SCCs (or another mechanism) in place with a transfer impact assessment, and document the period of non-compliance. If the data is sensitive or the volume large, assess whether a regulator notification is required under the breach rules - a missing transfer mechanism is not automatically a "breach," but it is a compliance incident that must be recorded and remediated.
The interaction: the access request may actually surface the transfer problem to the data subject. Respond factually about where their data is and the safeguards - do not conceal the gap, because concealment converts a fixable compliance issue into a trust and accuracy problem.
3. The data subject insists on "everything, including internal notes, in one response, within the month." How do you scope the response?
Read the worked answer
Scope by controller role, not by the data subject's framing. The response should:
- Disclose what the company controls (support system, account data) in full, with third-party redactions.
- Explain the split for tenant and sub-processor data: "for data in your employer's workspace, your employer is the controller; we have forwarded your request and will assist them." That is not a refusal - it is the correct routing, and it should be stated plainly.
- Include internal notes that are the data subject's personal data. The "internal notes" request is where companies over-refuse. Notes recording opinions about the employee are disclosable; notes that are pure internal deliberation with no personal data are not. Redact third parties, not the substance.
- Meet the deadline for what the company controls even if the customer's portion is still in flight. Partial, timely, explained is better than complete and late.
The judgement being tested: the data subject cannot expand the controller's obligations by asking for "everything," but the controller cannot shrink them by hiding behind "internal." Route what you don't control; disclose what you do.