A right of access, an explanation of an automated decision, a right to erasure: three requests a data protection officer cannot handle by searching production systems manually without risking errors and delays.
The scenario is fictional but representative of the requests any DPO receives today. It focuses on GDPR obligations and shows how KARL Core answers them: right of access, explanation of an automated decision, and right to erasure.
The setting: two requests received by Kelenia Crédit's DPO
Kelenia Crédit processes personal data to handle consumer credit applications, partly with the assistance of an agent, ARIA. The data protection officer (DPO) regularly receives two distinct types of requests: requests for access to and explanation of an automated decision (Articles 15 and 22 of the GDPR), and erasure requests (Article 17).
On 2 April 2026, Mr Reyval requests disclosure of the data underlying the refusal of his file DOS-2026-0847 and an explanation of the logic behind that automated decision. On 8 September 2026, a prospect wrongly contacted for marketing, Mr Castagnier, requests the erasure of his commercial profile. What follows retraces, screen by screen, how the DPO handles these two requests in KARL MX without relying on a manual search across production systems.
The right of access and the explanation of an automated decision (Art. 15 and 22)
The Memory Layer retains, for every state of a resource, the information needed for a complete GDPR response: the purpose of processing, the legal basis, the categories of data concerned, the planned retention period and, when an automated individual decision has been made, the exact policy that constitutes its underlying logic.
To document precisely the underlying logic required by Article 22, the DPO then queries governed retrieval: exactly which data was used, in which version, with none substituted for a later version.
Answering the right of access with a decision-type Evidence Pack
When the answer must be handed to the data subject or their counsel in a form that remains verifiable afterwards, the DPO produces a decision-type Evidence Pack: a sealed and signed scope, limited to the data underlying the decision, with every omission explicitly declared — here, the data of a third party who co-holds the file is not included.
This answer satisfies the transparency obligation without ever exposing more than the request allows: the « audit » disclosure profile makes it possible to declare a typed omission rather than blocking the whole export.
The right to erasure and its proof (Art. 17)
The second request raises a different requirement: proving that data has been deleted, without re-exposing it. KARL Core answers with a deletion-type Evidence Pack, whose content is limited to hashes, timestamps and the identity of the deletion event — never the personal data itself.
What it changes, function by function
| Function | Challenge | Answer provided |
|---|---|---|
| Data protection officer (DPO) | Answer a right of access, explanation or erasure request within legal deadlines | GDPR record and exact citations gathered in a few screens, with no manual search |
| Compliance and AI governance | Document the underlying logic of an automated decision with no approximate reconstruction | Exact citations (kind, stable_id, version) and applied policy, never inferred afterwards |
| Legal department | Prove a data deletion without re-exposing the data itself | Deletion-type Evidence Pack: proof by hash and timestamp, content never restored |
| IT department | Avoid multiplying manual extractions from production systems for every request | Sealed export, bounded to a precise scope, with declared rather than silent omissions |
In short
The two requests handled in this scenario illustrate the same mechanism applied to two different articles of the GDPR: the Memory Layer retains, for every resource, the information needed for a complete answer; governed retrieval cites exactly the data used by an automated decision; the Evidence Pack turns that memory into sealed evidence, calibrated to the strict scope authorised by the type of request.
The pack_type precisely distinguishes the purpose of the evidence: decision to justify an individual decision, deletion to attest to a deletion without re-exposing it. In both cases, every omission is declared and never silent.
Quick glossary
| Term | Meaning |
|---|---|
| Right of access (Art. 15) | Right to obtain disclosure of the personal data processed and related information |
| Automated individual decision (Art. 22) | Decision made without human intervention, whose underlying logic must be explainable |
| Right to erasure (Art. 17) | Right to obtain the deletion of personal data, under certain conditions |
| pack_type: decision | Evidence Pack type intended to justify a disputed or requested individual decision |
| pack_type: deletion | Evidence Pack type intended to prove a data purge, without re-exposing it |
| « Audit » disclosure profile | Allows typed omissions (unauthorised data) to be declared instead of blocking the export |
Kelenia Crédit, file DOS-2026-0847 and requesters Mr Reyval and Mr Castagnier are fictional. The screenshots come from the KARL MX interface running on a demonstration dataset: the mechanism shown is real, the data is not.