3 ms·

Do you think that a request from a user to access backup data is legitimate? If so, please take another read at the user's rights: https://ico.org.uk/for-organi

• jacquesm 8y ago
  The user made no request to access backup data, I don't know where you got that but it was not in the letter. The user requested to know if there were backups and if so how they are handled, which is a perfectly legitimate question, if only because quite a few breaches start with 'we've lost a backup and it wasn't encrypted'. This could - but does not necessarily - fall under 'other supplementary information' but would require more context. see: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/ https://ico.org.uk/for-organisations/guide-to-the-general-da... Now, some of the requests in the letter are over the top but there is no harm in answering them. Not answering the whole letter is extremely dumb because you can't ignore a legitimate request because it asks for one thing that is not legitimate. Then you should just answer the remainder and lay out your reasons for not wanting to answer the questions you feel are not within the scope of such a request.