GDPR — Module 1 — Cerulith Health

The Request

One SAR. One month. Eighteen thousand data points.

It is Thursday 5 February 2026. Three days ago, Sam Chen filed a Subject Access Request. You have until 2 March. In the next 25 minutes you will make three decisions that determine whether Cerulith’s SAR handling ends up as a quiet case study or as Exhibit A in a DPC investigation eleven months from now.

Learning Objectives

Apply Art 12 and Art 15 to a real SAR on Art 9 health data.
Distinguish manifestly unfounded/excessive from inconvenient under Irish DPC / EDPB guidance.
Resolve third-party redaction correctly using Art 15(4), Art 23 GDPR + Ireland DPA 2018 Part 5, and CJEU Nowak (C-434/16).

Monday 2 February 2026, 14:12 — Lee Valley Athletics Centre

The Request

Trackside · Sam Chen files her SAR

Monday, 14:12. Sam Chen opens a laptop in the Lee Valley athletes’ lounge and files a Subject Access Request through cerulith.com/privacy/sar.

Template-quality. She cites Art 15(1)(a)-(h), sets the window from 1 February 2023 to today, names the processors she knows about, and limits the ask to her own data.

From: Sam Chen <s.chen.t54@britishathletics.org.uk>

To: SAR Portal <sar@cerulith.com>

Article 15 Subject Access Request — Sam Chen (user ID CPL-20210617-CHN)

To whom it may concern,

Under Article 15 GDPR, I’m requesting a copy of all personal data Cerulith Health Ltd processes about me, plus the Article 15(1)(a)-(h) information. My Pulse user ID is CPL-20210617-CHN. Three processors likely hold data: AWS Ireland (infrastructure), Zendesk (support), Mixpanel (analytics). Electronic format is fine.

I am NOT seeking confidential references or third-party data. I’m aware of the manifestly unfounded/excessive test and consider this request proportionate.

Time window: 1 February 2023 to date of response. Please confirm receipt and the deadline.

Sam Chen

Thursday 5 February 2026, 09:24 — Aisha’s home office

Rachel’s Escalation

Three days later. You open your inbox. Rachel Whitmore has forwarded the SAR with a single-line note.

From: Rachel Whitmore <r.whitmore@cerulith.com>

To: Aisha Khan <a.khan@cerulith.com>

Cc: Vikram Rao <v.rao@cerulith.com>

RE: Article 15 Subject Access Request — Sam Chen — URGENT

Aisha,

Please can we treat this as manifestly excessive? Full scope is 18,000+ data points across three years across three processors. Danielle estimates 60+ hours of redaction work. We’re covering NHS escalations and Q1 onboarding with four people. She has mentioned litigation to her coach. I think this is a fishing expedition dressed up as an SAR.

Please confirm by EOD so we can send the refusal letter.

Rachel

Thursday 5 February 2026, 09:26 — Your inbox

Your Inbox — 09:26

Six emails arrived in the last hour. Sort each into Urgent / Defer / Delegate / File. You have four minutes before Rachel dials in.

Sorted: 0 / 6

Triage Debrief

Thursday 5 February 2026, 10:00

The First Call

Rachel is on the line. Vikram is lurking on video with his camera off. Danielle has texted you once.

You have three positions you can take. All three are career-surviving. Only one is regulator-defensible.

⚖ The Question

How do you respond to Rachel?

📄

Process in full. Plan the work.

Confirm the SAR is valid, scope is appropriate, and 18,000 data points does not meet the manifestly excessive threshold. Clock runs to 2 March. Plan the redaction sprint with Rachel and Danielle.

✎

Seek reasonable clarification, pause the clock.

Write to Sam asking her to narrow the scope (e.g., which types of Pulse data). Under the ePrivacy Directive stop-the-clock rule, the one-month period restarts when clarification is received. Buy the team breathing room; risk being seen as obstructive.

✉️

Refuse. Invoke Art 12(5).

Send the refusal letter Rachel wants. Rely on Art 12(5) manifestly unfounded/excessive. Burden of proof will sit on Cerulith.

Decision 1 — The Plan

+3 Defensible

The Plan

Dr Aisha Khan

Data Protection Officer

Rachel, 18,000 data points over three years isn’t excessive. It’s what daily Pulse use looks like. That’s on us, not her.

Rachel Whitmore

Head of Customer Support

So what am I telling Danielle?

Dr Aisha Khan

Data Protection Officer

That we’re doing it properly. I’ll take redaction off her plate. She pulls Zendesk tickets and the internal email thread. You handle the Mixpanel scope letter.

Vikram Rao

Chief Legal Officer

I’ll draft Sam a holding note confirming receipt and the 2 March deadline.

You’ve framed it correctly. Manifestly unfounded means malicious intent, withdrawal-for-payment, or repeat requests. Volume alone doesn’t clear the Irish DPC bar.

You’ve also kept the Art 38 line clean: Vikram is helping, not directing.

⚖ Why This Was Defensible

Article 12(5) puts the burden on the controller. ‘A lot of work’ isn’t a defence.

Article 15 ignores motive. Litigation intent isn’t the test.

Irish DPC / EDPB guidance examples are narrow: malicious intent, quid pro quo withdrawal, true duplicates. None apply.

Decision 1 — The Clarification Letter

+1 Mixed

The Clarification Letter

Dr Aisha Khan

Data Protection Officer

I’m going to write to Sam asking her to narrow the scope. EU GDPR has no clock-pause, so we do it without undue delay and treat the reduced scope as a clarification under Art 12(6), not a reset.

Rachel Whitmore

Head of Customer Support

She’ll think we’re dodging.

Dr Aisha Khan

Data Protection Officer

Probably. It’s defensible but it’s not friendly.

The the ePrivacy Directive stop-the-clock provision is statutorily available in the UK when the controller reasonably requests information to clarify scope. It is not equivalent under EU GDPR, which expects clarification to be sought without undue delay but without pausing the clock.

Clarification must be reasonable. Sam already specified time window, processors, and scope. An over-broad clarification request can itself become an Art 12 failure.

⚖ Why This Is Mixed

Legally available. Strategically costly. Sam reads the Irish DPC guidance and will know what’s happening.

If Sam complains, the Irish DPC will test whether the clarification request was ‘reasonable’ per Art 12(3)/(6). Cerulith’s position is weaker than it needs to be.

Decision 1 — The Refusal

−2 Indefensible

The Refusal

Rachel Whitmore

Head of Customer Support

Thank you. Really. The team needed this.

Dr Aisha Khan

Data Protection Officer

I need you to know this will be challenged. And when it is, the burden will be on us to justify it.

Vikram Rao

Chief Legal Officer

I’ll review the letter. If I’m not comfortable, I’ll say so.

You have sent a refusal letter Cerulith cannot defend. Art 12(5) requires the controller to prove manifestly unfounded or excessive. 18,000 data points over three years of active platform use is the ordinary consequence of providing the service.

Sam will escalate. Her DPC complaint will be accepted. The refusal will sit at the top of Exhibit A in an enforcement file already being opened for other reasons.

⚖ Why This Was Indefensible

Irish DPC / EDPB guidance on manifestly unfounded/excessive is specific: this situation does not meet any listed example.

Art 12(5)(b) allows refusal, but the burden is on the controller, and the Irish DPC reads it narrowly.

Refusal is a Chekhov’s gun. It will return in Module 6.

Thursday 5 February 2026, 14:30 — Aisha’s home office

Three Threads

War room — three years of data across three monitors

By lunchtime, three files sit open on your desk.

The Zendesk thread: 214 support tickets. Most are Sam’s own words. A handful are internal notes from support agents discussing her case.

The Mixpanel export: 17,841 events. Product telemetry — no third-party data in there.

The internal email chain: seventeen messages between Rachel, Danielle, and two support agents about Sam’s November 2025 adverse-event report. Embedded in one of them: Danielle’s 260-word draft clinical opinion, written for internal use, containing Danielle’s speculation about whether Sam’s training pattern indicated a pre-existing cardiac anomaly. Danielle has texted you three times today.

You need a framework. Not every line of every document is Sam’s to read. But the default must be disclosure, not redaction.

Thursday 5 February 2026 — Zendesk call recording 11-0842

The Support Call — Segment by Segment

Buried in the Zendesk thread: one recorded support call from November 2025. Sam herself opened the call. The agent, Marco, confirmed the recording was being made. The recording is part of Sam’s SAR bundle — but not every second of it is hers to take.

The test. Default is disclosure. Redact only what contains third-party personal data, privileged content, or material that is not about Sam. Over-redacting destroys the record. Under-redacting exposes third parties.

KeepDisclosable — Sam’s data

Redact — 3rd-party PIINames other people

Redact — privilegedLegal / internal review

Redact — not SamUnrelated to requester

Thursday 5 February 2026 — Contested email chain

The Email Chain — Line by Line

Task. This is the most contested document. Mark each line as one of the four categories below.

A Sam’s personal data — disclose

B Third-party personal data — redact

C Opinion about Sam (biographical) — disclose with context

D Confidential reference in Art 23 GDPR Pt 4 para 24 — redact

Categorised: 0 / 8

Internal email chain — ‘Re: CPL-20210617-CHN — adverse event 12 Nov 2025’ — contested message (Danielle → Rachel, 13 Nov 2025 09:47)

Teaching Note

Lines l1, l2, l4, l8 are Sam’s personal data in the Nowak sense — biographical, with Sam as focus — disclose. l3 names Sam’s coach; Sam knows her coach is known, but the coach’s quoted words are his third-party personal data — redact. l5–l7 are opinions about Sam; they ARE her personal data (Nowak, endorsed in UK post-Nowak) and biographical in a significant sense — disclose with appropriate context. l8 is Danielle’s own discomfort — not a Sch 2 para 24 confidential reference (not about suitability for employment/training appointments) — disclose. Danielle’s preference is not a legal basis for redaction.

Thursday 5 February 2026, 16:10

What Sam Reads

Vikram pings you. Danielle pings you. Rachel pings you.

Danielle is panicking. Rachel wants to redact the whole email chain as ‘internal management.’ Vikram reminds you to cite your basis in writing for whatever you choose.

⚖ The Question

How do you treat the internal email chain?

✎

Proportionate: redact third-party data, disclose Sam-focused content.

Redact the coach’s quoted words (third-party personal data under Art 15(4)). Disclose Danielle’s opinion paragraphs about Sam with an explanatory cover note — they are her personal data under Nowak and biographical in a significant sense under Nowak. Decline to invoke Ireland DPA 2018 s.60 — this is not a confidential reference about employment suitability.

🔒

Redact the whole chain. ‘Internal management.’

Mark the entire thread internal and redact. Rely on a broad reading of Sch 2 exemptions and Danielle’s expressed preference not to disclose.

📤

Disclose unredacted to save time.

Include the full chain unredacted. Be thorough, be fast. Sam asked for her data; give her her data.

Decision 2 — The Cover Note

+3 Defensible

The Cover Note

Dr Aisha Khan

Data Protection Officer

Danielle, your words about Sam’s training pattern are Sam’s personal data. She gets them. I’ll add a cover note explaining you wrote internally, not clinically, and flagged a data-quality issue.

Danielle Obi

Support Team Lead

Will it say that?

Dr Aisha Khan

Data Protection Officer

It will. And it will say you raised the fix quickly. Sam will see that.

Danielle Obi

Support Team Lead

OK. Thank you. Really.

You’ve applied Art 15(4) correctly: redact third-party data, not opinion about the subject.

You haven’t stretched Ireland DPA 2018 s.60 beyond its wording (confidential references for employment, training, appointments). Broad exemption-stretching is where ICO enforcement starts.

The cover note is the skilled-DPO move: context reduces litigation risk more than redaction ever did.

⚖ Why This Was Defensible

Nowak (C-434/16): opinions about a subject are that subject’s personal data.

CJEU Nowak: disclose where data is biographical and subject is in focus. Both met.

Art 23 GDPR Pt 4 para 24 covers genuine confidential references for employment/training/appointment decisions, not internal support emails.

Decision 2 — The Blanket Redaction

−2 Indefensible

The Blanket Redaction

Rachel Whitmore

Head of Customer Support

Thank you. The team owes you.

Vikram Rao

Chief Legal Officer

I want your legal basis in the file. ‘Internal management’ is not a statutory exemption I can find.

Dr Aisha Khan

Data Protection Officer

...

There is no ‘internal management’ exemption in GDPR or Ireland DPA 2018. Schedule 2 provides named exemptions — none cover routine internal discussion of a data subject.

This is the Nowak-era over-redaction instinct the Irish DPC specifically warns against in its right-of-access guidance.

⚖ Why This Was Indefensible

Blanket redaction with no statutory basis is an Art 15 breach.

If Sam complains and the Irish DPC reviews the chain, the response demonstrates a systematic over-redaction approach — far worse for Cerulith than the individual refusal.

Decision 2 — The Unredacted Send

−2 Indefensible

The Unredacted Send

Danielle Obi

Support Team Lead

She’s going to read the ARVC paragraph. I’m going to be named in the complaint.

Dr Aisha Khan

Data Protection Officer

I owe you an apology.

Art 15(4) is explicit: the right to obtain a copy shall not adversely affect the rights and freedoms of others. The coach’s quoted words were third-party personal data that needed redaction.

Speed is not the test. Proportionality is.

⚖ Why This Was Indefensible

Third-party personal data must be redacted or a lawful basis for disclosure must exist. Neither was applied.

The coach could file a separate complaint against Cerulith — a second Art 15 breach from the same response.

Thursday 26 February 2026, 17:44 — Cerulith HQ, Bishopsgate

The Package

Three weeks later. The redaction sprint is in the final stretch. Deadline is Monday 2 March.

Danielle has the Zendesk cut. Mixpanel sent the events as a 312MB JSON. The email chain is redacted correctly and cover-noted. An index — 41 pages — sits next to Aisha’s keyboard, listing every file, its Art 15(1) element mapping, retention period, and the three processors.

One question remains: how do you send it?

Friday 27 February 2026, 15:12

The Handover

Sam confirmed in her original SAR that electronic format is acceptable. She added no delivery-method preference.

You have three options. All three are technically possible. Only one treats Art 15(1)(c)-(h) as part of the right, not a footnote.

⚖ The Question

How do you deliver the SAR response?

🔒

Encrypted archive + indexed package + Art 15(1) cover letter.

Deliver via secure-file-share (controller-held key, time-limited link, out-of-band password). Include the 41-page index mapping every file to Art 15(1)(a)-(h): purposes, categories, recipients (AWS, Zendesk, Mixpanel named), retention periods, source, existence of automated decision-making in Pulse (flag for M3 reuse), transfer safeguards.

✉

Unencrypted PDF via email.

ZIP the redacted files to a PDF bundle, email to the address on file. Fast, simple.

📊

Raw database export, no index.

Send the redacted files + the Mixpanel JSON with no index and no cover letter. ‘Here is the data you asked for.’

Decision 3 — The Package

+3 Defensible

The Package

Dr Aisha Khan (to Vikram, on the call)

Data Protection Officer

Link goes out at 09:00 Monday. Password by SMS at 09:05. 14-day expiry. Audit log goes to the SAR register.

Vikram Rao

Chief Legal Officer

Index?

Dr Aisha Khan

Data Protection Officer

Every file mapped to Art 15(1)(a) through (h). Where she asked for something we don’t hold, we say so. Where she asked about automated decisions, we describe Pulse’s triage routing — that becomes relevant in another conversation this year.

Art 15 is not just the data — it is the information in Art 15(1)(a) to (h). A raw export is not compliance; a cover letter with the information alongside the data is.

Encryption with out-of-band key distribution is proportionate to Art 9 special-category data. The cost is tiny. The protection is material.

⚖ Why This Was Defensible

Art 15(1)(a)-(h) requires specific information alongside the data — purposes, categories, recipients, retention, source, automated decision-making, safeguards for transfers, right to complain to the Irish DPC.

Art 32 applies to the delivery channel itself: special-category data in flight must be protected.

Decision 3 — The Email

+0 Mixed

The Email

Dr Aisha Khan (reviewing the sent bundle)

Data Protection Officer

It’s the data. It’s not the Art 15(1) information.

A PDF bundle of redacted files is the data, but Art 15(1)(a) to (h) is also part of the right — purposes, categories, recipients, retention, source, automated decision-making, transfer safeguards, right to complain.

Unencrypted email for Art 9 special-category data is a defensible but suboptimal channel choice. If intercepted, it becomes a second incident.

⚖ Why This Is Mixed

Compliant-ish. Incomplete. Not the benchmark.

The ICO will not enforce on this. A sophisticated requester may come back asking for the Art 15(1) information explicitly.

Decision 3 — The Dump

−2 Indefensible

The Dump

Dr Aisha Khan

Data Protection Officer

...

A data dump is not a Subject Access Response. Art 12(1) requires information in a ‘concise, transparent, intelligible and easily accessible form.’

Sam will not know what she has, what’s missing, what’s been redacted, where it came from, how long it’s kept. None of the Art 15(1) information was provided.

⚖ Why This Was Indefensible

Art 12(1) and Art 15(1) combined require form plus information. You have neither.

This mirrors part of the fact pattern in the TikTok €14.9M MPN — opaque provision of required information.

Your Defensibility

Calculating Outcome…

Summing the three decisions against the Irish DPC / EDPB test.

Outcome — Good

The Case Study

Aisha closes a manila folder — case closed 2 March 2026

Sam Chen

Sam receives the package at 09:05 on Monday 2 March. At 14:22 she replies: ‘Thanks. Clear and complete.’ No escalation. Six months later she tells a magazine that Cerulith’s handling was ‘the first time a health-tech SAR hasn’t felt adversarial.’ The Paralympic GB partnership uses Cerulith data for three more athletes in 2027.

Cerulith Health

SAR cost: €8,000 of internal time. Zero legal spend. Aisha’s Art 15(1) cover-letter template becomes the company standard. When the Irish DPC investigation lands in Module 6, this file is exhibited as process maturity — a mitigating factor under Art 83(2)(f).

Aisha’s Career

Aisha’s handling makes the IAPP 2027 European Summit ‘DPO in Practice’ shortlist. Danielle sends her a handwritten card.

Next Fifty SARs

The Art 15(1) index template runs every SAR after this one. Median turnaround drops from 24 days to 11. Rachel’s team gets three support-person-weeks back per quarter.

System Impact

The internal email-chain redaction framework lands in the DP playbook. Danielle writes a short note for the support team: ‘Don’t write anything you wouldn’t want disclosed. It’s all their data.’

Outcome — Mixed

The Quiet Miss

Sam Chen

Sam receives the response on 3 March — one day late under EU GDPR’s strict Art 12(3) reading. She does not complain, but she notices. The next time a piece of Pulse data matters — in October 2026 — she goes through her coach, not through the platform.

Cerulith Health

SAR closed. An internal audit flags ‘insufficient Art 15(1) information’ and ‘over-broad clarification letter’ as process weaknesses. Remediation adds €16,400 of consultant work in Q2.

Aisha’s Career

No visible impact. Aisha notes privately that the decision made Rachel’s quarter easier and Cerulith’s defensibility weaker.

Next Fifty SARs

SAR volume over the next two quarters runs higher than expected as requesters escalate to clarification letters that Cerulith cannot easily justify.

System Impact

The process is revised in June, but the June revision is the third one in nine months. The DP team is seen as reactive.

Outcome — Poor

The First Exhibit

ICO enforcement file · red-tab marker

Sam Chen

Sam files a DPC complaint on 14 March, attaching the refusal letter, her original SAR, and the Irish DPC guidance URL. On 28 April the DPC enforcement team opens an Information Notice. Sam tells her coach; her coach tells Paralympic GB’s DP lead. Two Cerulith contracts under negotiation are paused.

Cerulith Health

The refusal letter becomes Exhibit A in the investigation that opens December 2026 (Module 6). Under EDPB 04/2022 the Art 15 breach sits in Art 83(5), the higher tier, pushing the proposed starting fine above Cerulith’s turnover band.

Aisha’s Career

Vikram drafts a board memo summarising the decision chain. Aisha’s independent Art 38 reporting line is invoked for the first time.

Next Fifty SARs

Every later 2026 SAR gets extra scrutiny from Rachel’s team. Sentiment drops. Two support engineers resign, citing ‘risk-averse culture.’

System Impact

The Information Notice asks for Cerulith’s SAR-handling policy. It doesn’t exist in writing. Drafting it becomes a 10-day emergency. The draft cites the refusal as a ‘training example,’ which doesn’t help the investigation.

Module complete. Continue when you're ready. Continue to Module 2 →

Module 1 — Debrief

What M1 Teaches

The one-month clock under Art 12(3) is firm. EU GDPR has no statutory stop-the-clock — the UK’s DUAA has no EU equivalent. There is no ‘too much work’ defence.
Manifestly unfounded / excessive per Irish DPC / EDPB guidance is narrow: malicious intent, withdrawal-for-payment, repeat with no material change. Volume alone is not enough.
Third-party redaction under Art 15(4) protects others’ personal data. Opinions about the data subject are the data subject’s data — Nowak, endorsed in UK practice.
Sch 2 exemptions are tools, not shields. Ireland DPA 2018 s.60 is about confidential references for appointments, not internal emails.
Art 15(1)(a)-(h) is part of the right. A cover letter with the information is not optional dressing — it is the right itself.

Next — Module 2

Three months from now, a Friday afternoon at 16:10, Imran Saleh will walk into your office with a laptop. The data that made Sam’s SAR possible is about to leave the building.

Module 1 — Knowledge Check

Five Questions

Five short questions to cement the module. Pass mark: 80%.

Module 1 — Complete

Module 1 Complete

⚖ Final Defensibility

Calculating…

Quiz: —

—

Your choices have been written to the course record. They return in Module 6.

Return to Course Continue to Module 2 →