Question

A privacy engineer is designing the technical workflow to fulfill data subject access requests (DSARs) across a company's microservices architecture, where personal data about a single individual is distributed across a CRM, a support ticketing system, a marketing platform, and multiple event-logging databases keyed on different identifiers. The compliance team requires that responses be complete within the statutory deadline and include all data associated with the requester. Which design approach BEST ensures accurate and complete DSAR fulfillment?

Accepted Answer

Implement an identity resolution layer that maps the requester's disparate system identifiers, then orchestrate automated collection queries against each mapped data store

Answer

Query only the CRM as the authoritative system of record, since it contains the master customer profile linked to all other systems

Answer

Export full database dumps from each system to a central location and manually search for the requester's email address each time a request arrives

Answer

Rely on each system owner to receive DSAR notifications by email and independently return whatever data they believe is relevant