Running a data rights audit before regulators do

# Running a data rights audit before regulators do

A subscriber to a European streaming service emails support asking a simple question: "What data do you hold on me, and who have you shared it with?" This is a Subject Access Request (SAR), a legal right under the EU's General Data Protection Regulation (GDPR) and the UK GDPR, letting any individual demand a full copy of their personal data and an account of where it went.

The streaming company has 30 days to answer. Its privacy team pulls the customer record and finds: viewing history synced across three internal systems, a marketing profile shared with an ad-tech vendor eighteen months ago, and a consent log that stops updating in 2023. Nobody can confirm whether the customer ever agreed to that ad-sharing arrangement.

This is not a hypothetical. It is the kind of gap that regulators, journalists, and plaintiffs' lawyers actively hunt for. This lesson builds the audit checklist that should catch it first, internally, before a SAR or a headline does.

Why media companies are exposed

Media and entertainment companies sit on unusually rich personal data: viewing habits, listening history, location (for regional rights enforcement), payment details, and behavioral profiles used for ad targeting. That richness is commercially valuable and legally risky at the same time.

Three regulatory regimes matter most in 2026:

• GDPR (EU, enforced by national Data Protection Authorities, DPAs, like Ireland's Data Protection Commission which oversees many US tech and media firms' EU operations)
• UK GDPR and Data Protection Act 2018, enforced by the Information Commissioner's Office (ICO)
• US state laws, notably the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), enforced by the California Privacy Protection Agency (CPPA), plus similar laws now active in Colorado, Virginia, Connecticut, and others

There is no single US federal privacy law as of 2026. This patchwork means a media company operating in the US, UK, and EU faces three different rulebooks for the same customer record.

The three audit pillars

A data rights audit before a regulator arrives should focus on three things a SAR, a regulator's inquiry, or an investigative journalist will always test first.

1. Consent trails

Consent is not a checkbox at signup. It is a live record that must show: what was agreed, when, under what privacy notice version, and whether it was later withdrawn.

What to check:

• Can you produce, for any single user, the exact consent text they saw and the date they accepted it?
• If a user withdrew consent (for marketing emails, for example), does that withdrawal propagate to every system that touches their data, including third-party ad platforms?
• Do you have consent on file for special categories of data? Media companies increasingly infer sensitive attributes (political leaning from news consumption, sexuality from content preferences), which GDPR treats as "special category data" requiring explicit consent, not just a general terms-of-service click.

A common gap: consent recorded at the account level but not at the device or profile level (think shared family streaming accounts with children's profiles).

2. Retention limits

GDPR's data minimization principle requires holding personal data no longer than necessary for the stated purpose. Most media companies have a retention policy document. Far fewer have systems that actually enforce it.

What to check:

• Pick a data category (say, watch history) and ask: what does the policy say the retention limit is, and does a query of the production database confirm data older than that limit has actually been deleted or anonymized?
• Are backups included in retention enforcement, or does deleted data quietly survive in a backup for years?
• Do former subscribers' records get purged, or do they linger indefinitely "in case they resubscribe"?

A simple technical check that regulators and auditors both use:

-- Sample audit query: find records older than stated retention policy
SELECT user_id, data_category, created_at
FROM user_activity_logs
WHERE data_category = 'watch_history'
  AND created_at < NOW() - INTERVAL '24 months'
LIMIT 100;

If this query returns rows and your policy says 24 months is the limit, you have a finding, before anyone else does.

3. Third-party dataThird-party dataData purchased from external aggregators, collected from audiences you don't own. It is bought or licensed rather than gathered through your own direct relationships.Voir la définition complète →-sharing logs

This is where the streaming company in our opening scenario failed. Media businesses routinely share data with ad exchanges, measurement partners (like Nielsen), recommendation engine vendors, and co-production partners.

What to check:

• Do you maintain a live, queryable log of every third party that has received personal data, what data, and under what legal basis (consent, contract, legitimate interest)?
• Under GDPR, "legitimate interest" as a legal basis requires a documented balancing test. Can you produce that document for each vendor relationship, on demand?
• Do data processing agreements (DPAs, contracts required under GDPR Article 28 when a third party processes data on your behalf) exist for every vendor, and are they current?

The UK ICO's guide to data sharing is a genuinely useful free reference for building this log structure.

Building the checklist: a worked walkthrough

Take a mid-size streaming or publishing company. Here is how a 90-minute internal audit session should run:

1. Pick one real subscriber record. Not a test account, a real one (with appropriate internal authorization).

2. Reconstruct their SAR response from scratch, as if they had just asked. Time how long it takes and note every system you had to query manually.

3. Check consent: does the record show what they agreed to, and when?

4. Check retention: is any data present that should have been deleted under your own policy?

5. Check sharing: can you list every third party who received this person's data, and match each to a signed DPA?

If step 2 takes more than a day of manual work across disconnected systems, that itself is a finding. GDPR's 30-day SAR deadline assumes you can do this at scale, not just for one flagged VIP account.

What regulators and journalists actually look for

Enforcement patterns from 2019 to 2025 across the EU and UK show a consistent pattern: fines and public findings rarely target the flashy AI model. They target the boring plumbing.

• Meta was fined a record amount by Ireland's DPC in 2023 (widely reported at approximately 1.2 billion euros, treated here as a well-known reported figure, not a newly verified one) largely over the legal basis for transferring EU user data to the US, a data-sharing basis issue.
• Multiple ICO enforcement actions against UK companies have centered on retention: keeping call recordings, CCTV, or customer records far beyond stated policy.
• Journalists investigating adtech (see reporting from outlets like The Markup, a nonprofit newsroom focused on technology accountability) routinely build stories around exactly this gap: what a privacy policy promises versus what a network traffic capture shows is actually being shared.

The pattern: the audit categories in this lesson (consent, retention, sharing) are not arbitrary. They are the three places every serious external investigation starts, because they are the three places policy and practice most often diverge.

🎬 [VIDEO: "GDPR Explained" - https://www.youtube.com/results?search_query=gdpr+explained+ico - a short explainer on core GDPR rights including subject access requests, useful as a refresher before running your own audit]

Key Takeaways

• A subject access request is a stress test: if you cannot reconstruct one customer's full data footprint (what you hold, why, and who else has it) within your own SAR deadline, you have a governance gap regulators will find eventually.
• Audit three pillars specifically: consent trails (what was agreed and when), retention limits (is old data actually deleted, including in backups), and third-party sharing logs (every vendor, matched to a legal basis and a signed data processing agreement).
• Run the audit on a real record, not a test account, and time how long a full reconstruction takes. Manual, multi-day reconstructions across disconnected systems are themselves a finding.