What are penalties for ignoring data-subject rights?

Ignoring a valid data subject request. whether that's access, erasure, rectification, or objection. isn't just impolite. Under GDPR, it's a violation with teeth.

GDPR penalties for data subject rights violations: Up to €20 million or 4% of global annual turnover, whichever is higher. These are the same top-line fines that apply to data breaches and consent failures. Regulators treat ignoring data subject rights as seriously as they treat collecting data without consent.

In practice, the most common enforcement path isn't a direct regulatory fine. it's a complaint from the person you ignored. When someone files a complaint with a Data Protection Authority (DPA), the DPA investigates. If they find you failed to respond, failed to respond on time, or provided an inadequate response, they can issue a formal reprimand, require you to comply, or impose the fine. The fine size typically scales with the severity, your track record, and whether the failure was deliberate or negligent.

Beyond the direct fine, there's reputational and operational exposure: the person whose rights you ignored can also bring a civil claim for damages in many EU jurisdictions, independent of the regulatory process.

Outside GDPR: CCPA in California allows private lawsuits for certain violations and regulatory action from the California Privacy Protection Agency. CASL has its own enforcement process, though it focuses more on commercial message consent than data subject rights.

The practical safeguard: have a documented process for receiving and responding to data subject requests before one arrives. If you handle it correctly and document that you did, there's nothing to enforce against. For the process itself, start with what a SAR is and how to handle deletion requests.