You are completely correct that simply blocking access does not make them compliant while they are still storing that data. But compliance isn't binary. I'm su

You are completely correct that simply blocking access does not make them compliant while they are still storing that data. But compliance isn't binary. I'm sure the data protection authorities understand the difference between “LOL I'm already noncompliant so I'll just continue business as usual” versus “Working hard to fix this – in the meanwhile, let's prevent covered Subjects from sending us more data until we are prepared to handle it compliantly.”