War-game a DSAR SLA by proving each request class has a named fulfiller, a measured clock, and a reverse path before the calendar starts governing every privacy request.
DSAR SLAs fail when "on time" means a checkbox without a decision artifact, when teams dual-count a draft export as both fulfilled and live, and when high-risk request paths still pin to one thin roster because the map is incomplete. The review needs one written inventory of request classes, one owner who can deny a risky shortcut, and a documented consequence when a failed fulfillment ages past the deadline.
Map the SLA before seating
List request classes by system, clock window, fulfiller roster, last skip reason, owner of record, and evidence required to close the ticket. Attach open findings, overdue requests, and any emergency waiver in the last quarter. Name which classes are out of scope and why. If a production identity class is omitted, show the residual risk in the same packet.
Decide allow, revise, or hold in advance. Include the fields that compute overdue-request status so two reviewers reach the same label from the same exports.
Decision gates
- Roster proof. Every critical class has at least two named fulfillers who completed a timed dry run in the last quarter.
- Clock proof. Exports show when each request ages and who receives the overdue alert.
- Exception proof. Logged exceptions list owner, expiry, and restore path; shared overrides fail the gate.
- Conflict proof. No fulfiller certifies their own standing access without a second set of eyes.
- Abort proof. A named person can freeze fulfillments at week end without waiting for the system owner.
Run four cases in Pingpong: a system still pinned to one overloaded fulfiller, a request that left partner data live without privacy review, a class that mixed interactive and service accounts, and a request to skip a production class because volume is rare. Start from the documented SLA language. Ask who can extend a clock window and which export proves completion. Any step that depends on an unnamed person becomes a freeze condition.
Replay one prior privacy incident under the proposed rules. If the incident would still age without a reverse owner, revise the rules before calling the SLA ready.
Pair with the privacy ops lead seat, an audit evidence pack review, and a retention schedule cut stress test. More operating decisions live in the war-game decisions hub.
Close only when approved and blocked labels can be reproduced from stored exports without a verbal override.