Accessing records is non-trivial. PII is stored across various services an organisation operates. These might have been built internally, or by external agencies. They may have a high bus factor, and it can be hard for someone new to figure out what data it stores, let alone query it. Auditing all your data and developing workflows for querying it can involve many people within multiple companies and potentially dozens of man-hours for a single Subject Access Request.
Deleting records can be difficult because of foreign key constraints. Blanking out data can be a way to work this in existing services, but new services will need to be designed with Subject Removal Requests in mind.
Server webapp