Do you know if there's really a requirement to provide requestors with your beliefs about the law, or with legal advice you've received?
Arguably, such technology doesn’t exist (at least when plugged into a computer network). What penalties are in place if you lie in the response?
There are technologies you can use (with varying degrees of effectiveness) to reduce the risk of data leaking by monitoring or intercepting specific mechanisms through which leaks can occur, but you can never have reasonable certainty in this respect.
At some point you will probably need to work with the real data to do anything useful with it. There are situations where you really can operate on obfuscated/encrypted data, such as comparing password hashes, but these tend to be the exception rather than the rule.
And so, if you're compromised at a point with access to the raw data, or anywhere else from which access to such a point can be gained, you've still lost control of the data.
And with lawyers and words I like to think of this quote:
"It depends on what the meaning of the word 'is' is. If the--if he--if 'is' means is and never has been, that is not--that is one thing. If it means there is none, that was a completely true statement....Now, if someone had asked me on that day, are you having any kind of sexual relations with Ms. Lewinsky, that is, asked me a question in the present tense, I would have said no. And it would have been completely true."
Request 9b is a bit tricky since the regulator have to be informed but not per se the data subject. Only if there is a risk for the data subject they have to be informed.
The letter is carefully worded itself. The parts the data subject does not have a direct right to know are friendly request (eg 4 vs 8b).
You can answer 8b just with one word: Yes. (Well or No)
The takeaway here:
If you give this letter to you technical personal you will get a detailed overview of the infrastructure they use.
If you give the same letter to your lawyer you would get a very polite letter with the bare minimum of information.
Example for 8b would be this: "We have technology in place which allows us with reasonable certainty to know whether or not you personal data has been disclosed"