Forty-one percent of in-house legal departments oversee how their companies respond to data subject access requests, according to Exterro’s 2020 Data Privacy Benchmarking Report, showing corporations understand the potential legal ramifications of these requests.

Data subject access requests are allowed under the California Consumer Privacy Act and the European Union’s General Data Protection Regulation to let consumers know what personally identifiable information a company keeps. According to the report released on Friday, 16% of respondents said the corporate privacy function handles responses to these requests and 14% said the compliance function handles them.