Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal nice

Article 13, to my reading, provides no basis for requiring locality information or security policies. The retention declarations I’ve seen have been legal niceties that don’t answer the question in a way that makes it clear what the retention policy is. I’m not suggesting that the letter won’t get a response. I’m suggesting there isn’t anything in it that would cause a large organization to send any different a response than if they got a letter written in crayon that said “gives us the GDPR data”. In that way it’s not a “nightmare” letter. It’s the default thing you pay lawyers for.