I asked 100 companies for my data. Some deleted it instead.
- ID
- 19356
- Status
- summarized
- Published
- 29 Aug 2026, 6:50 PM
- Fetched
- 29 Aug 2026, 8:52 PM
- Provider
- Ars Technica
- Category
- technology
- Original URL
- https://arstechnica.com/tech-policy/2026/08/i-asked-100-companies-for-my-data-some-deleted-it-instead/
- Source URL
- https://feeds.arstechnica.com/arstechnica/index
Summary
- Score
- 6.5
- Created
- 29 Aug 2026, 8:53 PM
- Tags
- Audience
- developerssaas_startup_foundersdatabase_learners
What happened
A journalist submitted personal data access requests to 100 companies and found that some responded by deleting the data rather than providing it, while others led to confusion and dead ends. The experiment highlights widespread unpreparedness in handling privacy requests under laws like GDPR and CCPA.
Why it matters
If you run a SaaS or any product collecting user data, your data-subject-access-request (DSAR) pipeline must distinguish 'give me my data' from 'delete my data'—confusing the two destroys user accounts and creates liability. Malaysian builders serving EU or US users face GDPR/CCPA exposure, and local PDPA amendments are tightening similar obligations, so now is the time to build correct export and deletion flows rather than panic-delete on request.
Discussion angle
Walk through what a correct DSAR handling flow looks like in a typical SaaS stack—how to separate data export from deletion, how to verify identity without creating new friction, and where Malaysian PDPA requirements overlap or diverge from GDPR/CCPA.