Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the O

Yes, but the researchers aren't asking about their data. They are asking about internal business policies, which they are not granted under the law. From the OP's links's FAQ: """ Why does this study involve contacting websites? Very few websites post details of their processes for handling GDPR and CCPA requests. Both the GDPR and the CCPA contemplate users and intermediaries reaching out with questions about data rights processes, and we are using that opportunity to understand current website policies and practices. """ From the sites I've seen discussing responsibilities, internal business processes for how GDPR requests are handled are not covered under GDPR. https://docs.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/gdpr-compliance?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/admin/securit... """ Data subject rights The GDPR establishes data subject rights, which means that, with respect to their personal data, customers, employees, business partners, clients, contractors, students, suppliers, and so forth have the right to: Be informed about their data: You must inform individuals about your use of their data. Have access to their data: You must give individuals access to any of their data that you hold (for example, by using account access or in some manual manner). Ask for data rectification: Individuals can ask you to correct inaccurate data. Ask for data to be deleted: Also known as the 'right to erasure', this right allows an individual to request that any of their personal data a company has collected is deleted across all systems that use it or share it. Request restricted processing: An individual can ask that you suppress or restrict their data. However, it is only applicable under certain circumstances. Have data portability: An individual can ask for their data to be transferred to another company. Object: An individual can object to their data being used for various uses including direct marketing. Ask not to be subject to automated decision-making, including profiling: The GDPR has strict rules about using data to profile people and automate decisions based on that profiling. """