Privacy rights work is intake, verification, then a tracked response.

Core GRC keeps the request, the identity check, and the SLA clock on one record. Automations can assign the next step. Reports show what is still open.