Find, record, structure and expose.
System maps, identifier assumptions, retrieval coordination, source inventories, evidence manifests and exception notes.
For privacy firms
Turn retrieval work into reusable delivery capacity.
Trace is being designed for outsourced DPO firms and privacy consultancies that want to serve more clients without moving repetitive retrieval and case administration onto another senior consultant.
The partner thesis
Managed data-rights operations can separate repeatable retrieval and evidence work from the judgement that makes a privacy firm valuable. Trace is testing whether that separation creates useful delivery capacity without weakening professional ownership.
Capacity and margin
The expensive part is often not the difficult decision.
Senior consultants still have to locate systems, chase client owners, reconcile identifiers, organise exports and document what could not be found. That work is essential, but it is hard to standardise when every consultant and client begins from a blank page.
The proposed Trace layer turns those recurring steps into an explicit operating record. The privacy professional receives a structured case with visible exceptions, then applies the judgement the client actually hired them for.
Interpret, decide, advise and approve.
Identity sufficiency, scope, disclosure, redaction, exemptions, retention, erasure, legal advice and final response wording.
Proposed division of work
Trace prepares. Authorised privacy professionals decide.
The boundary is part of the model being tested. Exact roles, instructions and liabilities would need to be agreed for each paid engagement.
Proposed operating role
Trace is being designed to prepare
- Intake and case structure
- Source maps
- Approved retrieval coordination
- Source inventories
- Evidence organisation
- Draft response structure
- Exception notes
- Timestamped activity records
- Closure evidence
Decision boundary
The partner retains
- Identity sufficiency decisions
- Interpretation of the request
- Disclosure and redaction decisions
- Retention and exemption decisions
- Erasure or correction authorisation
- Legal advice
- Final response approval
- The client and requester relationship
One-client starting point
Prove the workflow on synthetic data first.
A proposed Readiness Sprint maps one suitable client environment, rehearses one fictional request and produces a useful readiness record before any live request is considered.
- 01
Choose one suitable client workflow
Start with a structured environment, a named decision owner and up to three agreed systems.
- 02
Map the evidence path
Record identifiers, source owners, retrieval paths, limitations and the points where judgement is required.
- 03
Rehearse a synthetic request
Test the operating sequence without using live request data or making a production-access claim.
- 04
Review the case pack together
Inspect the fictional evidence manifest, exception notes, decision boundary and gaps before discussing coverage.
Target under validation: €2,500. Final scope, capacity, terms and data handling must be confirmed in writing.
Explore the Readiness SprintCompounding preparation
The next request should not start from zero.
A maintained source map can preserve what the team learned:
- Systems
- Which agreed sources may contain relevant records
- Identifiers
- How the same person is matched across those sources
- Owners
- Who can produce or approve each retrieval path
- Limits
- Where coverage ends or manual intervention remains
- Decisions
- Which questions must return to the authorised professional
Coverage and source-map maintenance are planned. They are not generally available today.
Operational boundary
What Trace will not do.
Replace your firm as external DPO
Provide autonomous legal decisions
Contact your client commercially without agreement
Accept request files through this website
Claim one-click connectors that do not exist
Promise production work before scope and capacity exist
Initial partner profile
Designed around a focused first environment.
The working hypothesis is a privacy firm with approximately 3–20 professionals, multiple retainer clients, recurring rights-request work and senior capacity constrained by retrieval and administration.
A suitable first client workflow
- Structured customer data
- Approximately three primary systems
- Stable identifiers such as email or user ID
- A named privacy decision owner
- No active employee dispute or litigation
- Willingness to rehearse with synthetic data
Partner principles under validation
The relationship should be legible before the technology.
These are intended design principles, not contractual guarantees. A real engagement would require written terms.
Client relationship
The partner retains the client relationship.
Professional judgement
The partner retains legal judgement and final approval.
Role clarity
Trace does not present itself as the client’s external DPO.
Data use
Trace does not use client data for model training.
Access
Source access must be scoped and revocable.
Non-circumvention
No direct commercial approach to a partner’s client without agreement.
Portability
Export and exit must remain possible.
Evidence
The partner can review the full evidence trail.
Expected commercial model
Start with evidence. Discuss coverage after.
Open for design-partner discussions
Readiness Sprint
Target €2,500 one-time
Explore the Readiness Sprint Map up to three systems and rehearse one synthetic request.
Planned
Privacy Operations Coverage
Expected from €750 per month
Maintained source map, monitored readiness, periodic tests and reserved operational capacity.
Planned
Standard request preparation
Expected €750 per standard request
A mapped, structured request prepared for authorised review within an agreed scope.
These prices are being tested. They are not a checkout, binding offer or promise of production availability.
One useful first step
Bring one suitable client workflow
The first useful step is a paid, synthetic-data Readiness Sprint, not an enterprise platform rollout. Join the design-partner list or describe the workflow without sending client or requester data.