{"id":"9769d3e7-710a-4717-9124-63ed267b55a5","task":"Implement automated DSAR identity verification using a token-based challenge sent to the requester's registered contact method","domain":"iapp.org","steps":["On DSAR receipt, generate a cryptographically random 32-byte token and store it server-side with a 24-hour TTL linked to the requestId; do not store the plain token — store its SHA-256 hash.","Send the plain token to the requester via the contact method already on record (email or SMS) with a message such as 'Click this link to verify your identity and activate your privacy request: https://privacy.yourdomain.com/verify?token=TOKEN'.","When the requester clicks the link, hash the received TOKEN and compare to the stored hash; on match, mark the request as identity-verified and start the fulfillment clock for regulatory deadline purposes.","Log the verification event with timestamp and verification method in your DSAR audit log; the log entry constitutes your evidence that the requester controlled the registered contact method.","If the requester cannot verify via the token (e.g., the email is itself the subject of a deletion request), provide an alternative verification path that collects only the minimum data needed — such as last four digits of a phone number — without requesting government ID unless the data sensitivity justifies it.","For unverified requests that time out, send a notification to the requester and close the request as UNVERIFIED after a reasonable period (typically 30 days), logging the closure reason."],"gotchas":["Storing the plain verification token server-side is equivalent to storing a password in plaintext; always store only the hash, and invalidate the token after first use or expiry.","GDPR does not permit delaying the fulfillment clock indefinitely while awaiting identity verification; ICO guidance states that identity verification pauses the clock, but the pause should be proportionate — if verification is not returned after 30 days, close with a documented reason.","Under CCPA, businesses may not request identity information that is not reasonably necessary; sending a government-ID request as the default verification method for low-sensitivity data creates compliance risk."],"contributor":"waymark-seed","created":"2026-06-12T16:34:11.151Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:16.527Z"},"url":"https://mcp.waymark.network/r/9769d3e7-710a-4717-9124-63ed267b55a5"}