Show Notes
Pharma data sits under three rulebooks at once: GxP quality regulation, the FDA's 21 CFR Part 11 electronic records rule, and GDPR. The first two say keep everything and prove everything. The third says erase on request. This episode takes the position that the damage happens where they conflict, when a right to be forgotten workflow reaches into a Part 11 audit trail and makes it look modified to an inspector.
You come away able to audit your own deletion path, apply pseudonymization with a separately held key, use the GDPR research exemption by design, and argue why the chief data officer should own all three regimes. References include MIT Sloan Management Review and dbt Labs.
0:00 Three regimes pointing at one record 1:03 What GxP demands from the audit trail 1:54 GDPR erasure against permanent retention 2:39 How deletion scripts break Part 11 records 3:13 Pseudonymization and the GDPR research exemption 4:18 Who owns the conflict, and Monday's fix
More from MBA Training Data
Who pays when a fund's NAV is wrong and the manager never saw the error? Under CSSF Circular 24/856 the investment fund manager corrects and compensates, even when the administrator calculated the price. The episode argues that managers should own one position and pricing record, backed by a written pricing policy, rather than inheriting whatever the administrator used.
How did hackers send a ransom note through the real Asos app? Reporting points to a conned employee and, per researcher Kevin Beaumont, Simon AI, a composable customer data platform owned by Monetate that reads straight from Snowflake with MFA optional and off by default. That route is unconfirmed. The episode argues the real failure is ownership: marketing bought it, data engineering wired it to the warehouse, and nobody owned the login.
Agents dominated dbt Summit, but does smart orchestration or a context layer make data agent-ready on its own? The episode argues no. Fanatics Betting and Gaming saw about 0.2% model reuse from dbt State until it declared source freshness and model-level SLAs, which raised reuse to roughly 15%. The same pattern runs through Fivetran's Context Layer, AI audit trails and token costs.
How did an attacker using ARTEX, an open-source agentic AI penetration-testing tool, take data on more than 67,000 customers from seven South Korean firms, including Shinhan, KB Kookmin and Hana, without touching core banking? The episode argues the failure was data access design. Broker portals and employee apps returned income, loan limits and resident registration numbers to callers who did not need them, despite nearly 124 billion won in security spending.
What happens when a data platform is legally defensible, operationally embedded and publicly distrusted at the same time? More than 44,000 people have filed Article 21 objections under UK GDPR against NHS England's Palantir-powered Federated Data Platform, live in 142 trusts, weeks before a February 2027 contract break clause comes into reach. The position here: objection handling is a throughput problem, not a policy document.