You receive a subject access request. Legal says you have 30 days to produce everything you hold about this person. What does your architecture need to make that possible?

What the interviewer is testing

Whether you appreciate that this is an architecture problem, not a legal process problem, and whether you know where personal data actually sprawls.

Why it is hard

Personal data is rarely confined to a customer table. It is in the operational database, the analytical warehouse, the search index, caches, message queues, application logs, the support ticketing system, the marketing platform, backups, and the export someone made to a spreadsheet.

A response covering only the systems the team remembered is incomplete, and completeness is the legal test.

What the architecture needs

A stable subject identifier that links records across systems, so a person can be located without fuzzy matching. Where systems use their own keys, an identity mapping service is the prerequisite.

A register of processing listing which systems hold personal data, what categories, under what lawful basis, and who owns them. This is separately required under most regimes and is usually the missing piece — without it, discovery is a survey conducted under a deadline.

Retrieval capability per system, ideally an API each system exposes that returns everything for a subject identifier. Building this once per system converts a multi-day manual exercise into an orchestrated query.

Orchestration and audit — a service that fans out, collects, assembles the response and records what was produced and when.

The related rights that share the architecture

Rectification, erasure, portability in a machine-readable form, restriction and objection all depend on the same capability: locate everything about a person. A system that can serve one can serve all; one that cannot serve any.

What a strong answer adds

Data minimisation as the cheapest control here. Every system that does not hold personal data is one you never have to search, and every attribute not collected is one you never have to produce. The architecture that handles subject rights well is usually the one that centralises personal data and has other systems reference it by identifier rather than copying it.

And volume planning: request rates rise sharply when a company is in the news, so a manual process consuming days of engineering time per request does not survive.

Common weak answers

Treating it as a legal or support workflow. Searching only the primary database.