- I am working for an institution which has recently suffered a data breach.
- There have also been articles in local press regarding the nature of the leaked data and claims about having access to extensive lists of breached data.
- On discussions with my institution's law department, I was (at last) informed about my leaked personal data at a descriptive level, however, the response seems incomplete compared to what I would expect that would have been leaked and what is also mentioned in the press.
- I am an EU resident working in an EU country, thus GDPR and any other relevant legislation apply here as well.
Question: Given the above, is it reasonable (and, furthermore, legally justified) to ask for a written confirmation of what personal data have not been leaked?