Data Privacy / GDPR-style Request Responder

We received this request from a user: {{paste}} under {{GDPR/CCPA/similar}}. 1) Classify the request (access/portability/erasure/rectification/objection) and identify what's verifiable identity info needed, statutory deadline (typically 30 days/45 days), and extensions allowed. 2) Data-map checklist: where could this person's data live (product DB, backups, third-party processors, support tickets, analytics, marketing lists); what's exempt (legal hold, transaction records, anonymized data). 3) Step-by-step fulfillment workflow with owners and logging. 4) Reply templates: acknowledgment within legal window, clarification of scope, completion notice, partial-denial with reasons (and appeal rights), and deletion request that conflicts with legal retention. 5) Internal flag: if this involves children, sensitive data, or a bulk incident, recommend DPO/legal escalation. Note I must verify jurisdiction details with counsel — this is operational guidance, not legal advice.