EXTIA Fined EUR 300,000: Your DSAR Triage Decision Tree

When 265 erasure requests land in your queue and you fail to respond to 166 of them, you're not just behind on tickets. You're broadcasting non-compliance. EXTIA learned this when CNIL imposed a EUR 300,000 fine for failing to process and inform individuals about their data erasure requests under GDPR Articles 12 and 17.

The decision you're facing isn't whether to handle Data Subject Access Requests (DSARs). It's how to triage them when volume exceeds capacity without violating Articles 12 and 17.

The Core Compliance Question

You receive an erasure request from a former candidate or employee. Within one month, you must either:

• Process the erasure and confirm it
• Refuse the request with a valid legal reason
• Request an extension (maximum two additional months) and explain why

EXTIA's failure wasn't ambiguous. Of 265 erasure requests received in 2024, over three-quarters were either ignored or mishandled. Twelve went completely unprocessed. Another 166 individuals never received any response. Twenty-seven more got responses months late.

The fine reflects what CNIL calls "infringement of essential principles relating to the rights of individuals." This wasn't a paperwork error. It was a systemic breakdown.

Key Factors That Determine Your Path

Before you choose a triage strategy, assess three variables:

Request volume relative to staff capacity. If you're receiving 20 erasure requests per month with one part-time operator, you're in a different situation than 265 requests with no dedicated headcount.

Data system architecture. Can you execute erasures from a single interface, or do you need to touch eight different databases, three backup systems, and a legacy CRM?

Legal basis for retention. Some data you must keep (payroll records, tax documentation). Some you can't erase because of pending litigation. Some has no retention justification once the employment relationship or candidacy ends.

EXTIA's problem wasn't unusual request volume. It was the absence of a system to track, route, and close requests within the Article 12 deadline.

Path A: Manual Triage With Documented Refusals

Choose this path when:

• You receive fewer than 50 DSARs per month
• Your data lives in structured systems (ATS, HRIS, CRM)
• You have clear retention schedules tied to legal obligations
• You can dedicate 2-4 hours per day to DSAR handling

How it works: You assign one operator to log every request in a tracking spreadsheet or ticketing system. Each request gets an immediate acknowledgment: "We received your erasure request on [date]. We'll respond within 30 days."

Then you evaluate each request against your retention schedule. For candidates who interviewed but weren't hired, you likely have no legal basis to retain their CV beyond six months. Erase and confirm. For former employees, you keep payroll records for the statutory period (often six years for tax purposes), but marketing preferences and performance reviews can go immediately.

Document every refusal with the specific legal basis: "We're retaining your salary records under [national tax code] until [date]. All other personal data has been erased."

The risk: Manual processes break when volume spikes. If you go from 30 requests to 200 in a quarter, you'll miss deadlines. EXTIA's two prior reminders from CNIL suggest they knew manual triage wasn't working but didn't change course.

Path B: Automated Workflow With Exception Handling

Choose this path when:

• You receive 50+ DSARs per month
• You have budget for a privacy management platform or can build internal tooling
• Your data architecture includes APIs or batch deletion capabilities
• You need to handle requests across multiple legal entities or jurisdictions

How it works: You implement a system that automatically:

• Acknowledges receipt within 24 hours
• Routes requests to the correct data controller
• Flags requests requiring legal review (active litigation, regulatory hold)
• Executes erasures in non-flagged systems
• Generates confirmation emails with specifics: "We've erased your data from [systems]. We're retaining [specific records] under [legal basis] until [date]."

Your operator reviews only the flagged exceptions and tracks the 30-day deadline through automated reminders.

The advantage: Scalability. When CNIL launched its Coordinated Enforcement Framework action on the right to erasure in 2025, EXTIA was already under scrutiny. Automated workflows would have surfaced the backlog before it became a EUR 300,000 problem.

The requirement: You still need human judgment for edge cases. Automated systems can't determine whether a former consultant's project documentation is covered by a client contract retention clause. But automation should handle 70-80% of routine requests without manual intervention.

Path C: Hybrid Model With Dedicated DSAR Team

Choose this path when:

• You're processing 200+ DSARs per month
• You operate in multiple jurisdictions with different timelines (GDPR's 30 days, CCPA's 45 days)
• You handle sensitive categories of data (health, financial services, children's data)
• You've already received regulatory warnings

How it works: You staff a dedicated DSAR team (minimum two FTEs) with defined escalation paths. Tier 1 handles standard erasure requests through the automated workflow. Tier 2 reviews refusals and complex cases. Legal reviews anything involving litigation holds or regulatory investigations.

You track three metrics weekly:

• Requests received vs. closed
• Average response time
• Refusal rate with documented legal basis

If your closure rate drops below 90% or average response time exceeds 20 days, you escalate to leadership before you hit the 30-day deadline.

Why EXTIA needed this: The scale of failure (166 individuals never informed, 12 requests completely unprocessed) suggests no one was tracking these metrics. CNIL noted that EXTIA had been "reminded of its obligations on two occasions" before the fine. Those reminders were the signal to move from Path A to Path C.

Summary Matrix

EXTIA's EUR 300,000 fine came from choosing Path A when they needed Path C. The volume (265 requests in one year) and failure rate (over 75% mishandled) weren't edge cases. They were evidence of a broken process applied at scale.

Your choice depends on current volume, projected growth, and system complexity. But every path requires the same foundation: acknowledge every request immediately, track the 30-day deadline, and document every refusal with a specific legal basis. CNIL made clear that "infringement of essential principles relating to the rights of individuals" carries financial consequences that scale with negligence.

If you're already behind, don't wait for the third reminder.