A data subject access request arrives on a Tuesday. Under GDPR Article 15, the person is entitled to a copy of their personal data and a description of how it's processed; under Article 17 they can require erasure. The clock runs: one month.
In most organizations, what happens next has little to do with law and everything to do with architecture.
Someone — usually whoever answered the privacy inbox — asks engineering: "Can we pull everything we have on this person?" And engineering discovers that the honest answer requires an excavation.
The main database, yes. But also the read replicas and the analytics warehouse the data was copied into. The CRM. The support desk, where the person's emails include personal details in free text. The email marketing tool. The invoicing system. Application logs, where a request path may embed an email address. Error trackers, which faithfully snapshot whatever variables were in scope. Backups — with their own retention schedule. And at least one spreadsheet exported eleven months ago for a campaign nobody remembers.
Each system has a different owner, a different query interface, and a different idea of identity — user ID here, email there, sometimes just a name in a text field. The "single request" fans out into a dozen tickets. Days of engineering time are consumed not by the legal obligation, which is simple, but by the fact that nobody knows precisely where personal data lives. Under Article 30 you're supposed to have a record of processing activities; the DSAR is where you find out how honest that record is.
Access requests only need to find data. Erasure has to remove it — everywhere — while respecting retention obligations that require keeping some of it (invoices, for instance, under tax law) and without breaking referential integrity in systems that were never designed for deletion.
So teams write deletion scripts per system. The scripts drift as schemas change. Someone builds anonymization for the warehouse because full deletion breaks the dashboards. Backups get a policy memo instead of a technical solution, because deleting one record from a thousand snapshots isn't feasible. Each new integration silently extends the checklist, and the checklist lives in a wiki page that's current for roughly one quarter.
This is why "right to erasure" projects appear in backlogs the way sea serpents appear on old maps — everyone believes in them, nobody has seen one finished.
Now run the same request against a different architecture: personal data is tokenized, the real values live in one system, and every other system holds references.
Access request: query the vault for the subject's values, plus a token-usage report showing which systems hold which references. One system, one query, one export. The fan-out disappears because there's nothing to fan out to — the warehouse, the logs, and the eleven-month-old spreadsheet contain tokens, which are not personal data once the mapping is severed.
Erasure: delete the subject's records in the vault. Every token, everywhere, in every copy and every backup, simultaneously becomes an opaque string referencing nothing. There is no per-system script to maintain, because the erasure happens at the only place the data ever was. Retention exceptions become vault policy — keep the invoicing-related values for the statutory period, release the rest — instead of conditional logic scattered through a dozen codebases.
The one-month deadline stops being a project-management problem. The work compresses from an excavation into a lookup: fifteen minutes, most of it writing the cover letter.
There's a simple diagnostic hiding in all this. The time your organization needs to fully answer a DSAR is a direct measurement of how well you actually know where personal data lives. A week means it's everywhere and the map is fiction. Fifteen minutes means the architecture itself is the map.
Most companies have never timed it, because most companies handle few enough requests that each one can be absorbed as a heroic effort. But request volumes trend one way, and regulators increasingly ask not whether you complied, but how you're able to. So it's worth asking before someone else does: if a DSAR arrived tomorrow morning — how long would yours take?