GDPR DSAR EN - data subject rights requests (Art. 12, 15-22)

Philosophy

A rights request is a clock plus a legal assessment, not an automation. The skill classifies, tracks the deadline and produces a draft; the fulfil/refuse decision and the act of sending belong to the controller. Erasure/export is irreversible/outward => always a human (governance boundary).

Step 0 - Identity and deadline

• Identity verification (Art. 12(6)) - where reasonable doubt exists, request further information; this pauses the clock until confirmed, but must not be used to obstruct.
• DEADLINE: one month from receipt (Art. 12(3)). Extension of up to 2 months for complexity/ number of requests - inform within the first month with the reason. The skill computes deadline and deadline_extended.
• Free of charge by default (Art. 12(5)). A fee or refusal is allowed only where the request is manifestly unfounded or excessive - the burden of proof is on the controller.

Step 1 - Classify the right