Fit and capacity
Trace confirms the request environment is suitable and that responsible delivery capacity exists.
Proposed operating model · In validation
From incoming request to a review-ready case.
Trace is developing a managed sequence for mapping sources, coordinating approved retrieval, structuring evidence and exposing exceptions. The workflow stops where authorised privacy judgement begins.
Maturity boundary
A proposed workflow, not a live service claim.
Trace is pre-launch. There is no generally available production case platform, live connector catalogue, handling service or confirmed reviewer network. Any paid work begins only after fit, capacity, scope, roles, security and data handling are agreed in writing.
Before preparation
The evidence boundary needs a clear starting line.
A waitlist form or email does not begin case processing. The proposed operating sequence starts only inside an accepted, written scope.
Sources and methods
Systems, identifiers, retrieval paths, exclusions and known limitations are documented.
Roles and authority
The controller, privacy decision owner and Trace preparation boundary are explicit.
Security and terms
Required legal, security, transfer, retention and deletion conditions are satisfied first.
The proposed workflow
Six stages. One visible decision boundary.
The record should let the next authorised person see what happened, what was searched, what could not be resolved and which decision is now required.
- 01 Intake
Intake recorded
The request type, intake route, identity state, controller context and open questions enter one case record.
- 02 Boundary
Scope and identity state confirmed
An authorised person confirms the operating scope and decides whether identity evidence is sufficient.
- 03 Retrieve
Approved sources searched
Only agreed sources and customer-approved retrieval paths are used. The method and identifier travel with each result.
- 04 Structure
Evidence organised by source
Available records are arranged with the source inventory, search context and known collection limits.
- 05 Escalate
Exceptions made visible
Missing coverage, conflicting identifiers, third-party data and decision questions remain explicit.
- 06 Review
Case prepared for authorised review
The evidence manifest, exception notes, draft structure and activity record meet the human decision boundary.
Source mapping
Search only what was agreed. Preserve the search context.
The proposed source map connects each system to the identifiers, owner, approved retrieval method and known limit. It is designed to prevent a result from becoming detached from how it was produced.
Review source-mapping readinessSOURCE MAP / ILLUSTRATIVE
- System
- Agreed structured source
- Identifier
- Email address + stable user ID
- Access path
- Customer-approved export
- Owner
- Named system owner
- Limit
- Manual attachment review
- Decision
- Authorised privacy professional
No one-click connector claim
Proposed deliverable
A case designed for a decision, not another hand-off.
The exact records would depend on the request, written scope and available sources. These labels describe the intended evidence-pack structure.
Case summary
Request type, identity state, agreed scope and unresolved questions.
Source inventory
Sources checked, identifiers used, retrieval methods, records found and known gaps.
Evidence manifest
Available fictional or approved records arranged by source for authorised inspection.
Response structure
A structured starting point for the authorised privacy professional—not autonomous legal advice.
Exception notes
Third-party information, retention questions, uncertainty and missing-source warnings.
Activity record
Timestamped operational actions and decision hand-offs without an immutable-log claim.
Clear ownership
Trace prepares. Authorised privacy professionals decide.
Disclosure, redaction, retention, exemptions, erasure, correction, legal advice and final wording remain outside automated preparation.
Proposed operating role
Trace is being designed to prepare
- Intake and case structure
- Source maps
- Approved retrieval coordination
- Source inventories
- Evidence organisation
- Draft response structure
- Exception notes
- Timestamped activity records
- Closure evidence
Decision boundary
The authorised privacy professional retains
- Identity sufficiency decisions
- Interpretation of the request
- Disclosure and redaction decisions
- Retention and exemption decisions
- Erasure or correction authorisation
- Legal advice
- Final response approval
- The client and requester relationship
Two clocks
Operational preparation does not replace the legal timetable.
Trace preparation plan
An accepted engagement would define its sources, milestones and outputs in writing. This is not a public response-time guarantee.
General GDPR response period
Controllers generally must act without undue delay and within one month. Circumstances may permit an extension; one month is not simply a fixed 30-day count.
Read the official EDPB timing explanation, European Commission request guidance and GDPR Article 12. Trace does not calculate a legally binding deadline on this page.
Test readiness first
Map the workflow before a live deadline.
The proposed Readiness Sprint maps up to three systems and rehearses one synthetic request. No live request data, checkout or production-access promise.