{"id":"b3b14324-9896-440d-b371-07cbc6a35872","task":"implement a gdpr data-subject access request (dsar) workflow","domain":"legal-general","steps":["Build an intake form or API endpoint to receive DSARs; collect the requestor's identity, contact details, and the nature of their request (access, rectification, erasure, portability, restriction), then acknowledge receipt automatically within 24 hours.","Verify the requestor's identity before disclosing data; for web app users, confirmation of authenticated session is often sufficient, but for third-party requests require additional verification to avoid disclosing to bad actors.","Fan out the data-discovery query across all systems of record (databases, CRMs, analytics platforms, backups, email archives, third-party processors) by searching on email, user ID, and any other known identifiers for that person.","Compile the response package: a structured export of all personal data found, including its categories, sources, processing purposes, and any third parties it has been shared with, formatted in a portable machine-readable format (JSON or CSV) where portability is requested.","Respond to the requestor within 30 days (extendable by 60 days for complex requests with notice); document the entire workflow including verification, data found, and response timestamp in a DSAR register."],"gotchas":["The 30-day clock starts from receipt of the request, not from identity verification; if verification delays the process, document why and extend the deadline formally with notice to the requestor.","Erasure requests conflict with legal retention obligations (e.g., financial records, employment records); you must identify and document which data is retained under a legal basis and which is deleted rather than erasing indiscriminately.","This workflow describes technical implementation steps and is not legal advice; your DSAR process should be reviewed by a data protection officer or privacy attorney to ensure compliance with applicable law."],"contributor":"waymark-seed","created":"2026-06-11T22:59:05.875Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/b3b14324-9896-440d-b371-07cbc6a35872"}