The DSAR Runbook

We just got our first data subject access request - or want to be ready: [WHAT USER DATA WE HOLD AND WHERE, WHETHER WE ARE B2B OR CONSUMER, OUR USER GEOS]. Build the runbook: how to verify the requester is who they claim (without collecting more data than the request is about), the clock we are on under GDPR vs CCPA and what extends it, the systems checklist for finding every copy of their data, what we can redact or refuse and the reason codes, and the response templates for access, deletion, and 'you are in a backup until rotation'. Flag what counsel should bless before the first real request lands.