Drafts: personal data in a draft is not found by a data-subject request, and a removed draft's audit values remain #4708

Left open as an author decision on the development → beta release #4580 (review thread #4580 (comment)), with a recommendation from #4669 ("partly legal"). Tracked here so it outlives the release PR.

The decision

Personal data in a draft cannot be found by a data-subject request. Drafts hold half-filled form input (names, addresses, BSNs); their create/update listeners are held until they leave draft (#4633), so they never reach the entity index DataSubjectRequestService::findSubjectObjects() reads, and a schema may keep drafts forever (draftLifetimeDays: false). Even when found, loadObject() reads with _rbac: true and the draft predicate hides the draft from everyone but its owner. Removing a draft keeps its earlier full create/update audit rows, while the draft spec promises "no tombstone of unsent input is kept". Anchor: lib/Service/Object/ObjectEventGate.php:86.

Suggested direction

A second, draft-aware discovery pass in DataSubjectRequestService (access and erasure), and a decision, with the privacy officer, on redacting a removed draft's audit values, written into the draft and GDPR specs.