Authority
The applicant can identify the controller and a person authorised to instruct and approve the case.
Methodology · Version 0.1
A review-ready case needs a visible evidence boundary.
This methodology defines the proposed acceptance gate, source record, review boundary, exception handling and quality checks. It is an operating standard under validation—not proof of production capacity or legal advice.
Working definitions
Start with language a buyer can audit.
- What is Trace?
- An early-stage managed privacy-operations product thesis focused first on preparing GDPR data-request cases for authorised human review.
- What is a DSAR?
- A common operational term for a data subject access request. Trace may also need to frame other rights requests, but the customer remains responsible for the legal classification and response.
- What is a review-ready pack?
- A scoped case summary, source inventory, available evidence, response draft, exception notes and activity record with open decisions made explicit.
- What does the Readiness Sprint test?
- It maps up to three systems, documents a proposed retrieval path and rehearses one synthetic request. It does not accept or complete a live legal case.
- Who responds to the person?
- The controller or its authorised representative. Trace does not assume that authority merely by preparing operational material.
- Does Trace make legal decisions?
- No autonomous legal-decision claim is made. Identity, exceptions, third-party rights, retention and final communication require authorised human judgement.
Official context: European Commission guidance on handling rights requests and GDPR Article 15. This page summarises an operating method, not the law.
Request frame
The right being exercised, receipt context, known date and immediate urgency are understandable enough to scope.
Identity path
The customer owns an appropriate verification decision and can state the current verification status.
Source boundary
Likely systems, requester identifiers, owners and material gaps can be named.
Access path
A controlled export, customer-run retrieval or narrow access route can be agreed before data transfer.
Review boundary
Disclosure, redaction, retention, correction, erasure and final wording have an authorised decision owner.
Capacity
Trace can perform the agreed Readiness Sprint work without implying production case handling or reviewer capacity.
Terms
Scope, price, data handling, retention, deletion, cancellation and responsibility are accepted in writing.
The Sprint boundary
What enters the rehearsal and what the output can prove.
The Readiness Sprint is a proposed mapping and synthetic-rehearsal engagement. It is not a service-level promise or the GDPR response period.
Rehearsal starts after scoped intake
- Written case scope accepted
- Instructions and decision owner recorded
- Agreed evidence path available
- No live request data used in the rehearsal
- Scope, roles and commercial terms agreed
Rehearsal reaches the review boundary
- Available evidence organised
- Source and gap inventory prepared
- Response structure drafted
- Exceptions and uncertainties flagged
- Case queued for authorised judgement
The Sprint does not mean
Identity is always verifiedEvery source is reachableEvery exception is resolvedErasure is executedThe response is deliveredThe legal case is closed
The general legal timing requirement is separate. See GDPR Article 12 and the EDPB explanation of the one-month period.
Source
The system, dataset, export or repository that was checked.
Owner
The customer role able to validate access and explain the source.
Identifier
The requester key used for lookup and its known matching limits.
Method
Export, query, API retrieval, manifest search or manual evidence import.
Time
When collection occurred and which case event records it.
Result
Records found, no records found, access failure or inconclusive search.
Transformation
Normalisation, deduplication or packaging applied after retrieval.
Gap
An unqueried source, missing identifier, incomplete export or unresolved ambiguity.
Proposed case sequence
Transform the format. Preserve the uncertainty.
The sequence aims to reduce coordination without laundering incomplete evidence into false certainty.
- 01 / FRAMEHuman-confirmed input
Record request facts and open questions
Preserve original receipt context, request wording, identity state, controller instructions and timing assumptions.
- 02 / MAPConcierge setup
Set the source boundary
Name expected sources, owners, requester identifiers, access methods and exclusions before retrieval begins.
- 03 / COLLECTControlled execution
Retrieve or import agreed evidence
Use the accepted path, record failures and resist expanding access merely because it is convenient.
- 04 / NORMALISETrace prepares
Organise without rewriting the facts
Structure records by source, deduplicate where justified and preserve original evidence alongside transformations.
- 05 / FLAGNo silent assumptions
Expose gaps and decision points
Mark missing systems, weak identifier matches, third-party information, retention questions and inconsistent results.
- 06 / DRAFTPack target
Prepare the review material
Assemble the source inventory, evidence package, response structure, action list and event record.
- 07 / DECIDEHuman boundary
Authorised people approve or escalate
Record the decision owner, rationale and next action. No automatic disclosure or erasure is inferred.
- 08 / CLOSECustomer authority
Deliver, retain and remove access as agreed
Only after approval: use the accepted delivery path, update the activity record and apply retention and revocation instructions.
Scope integrity
Every file and draft statement can be traced to an agreed source or a clearly labelled customer instruction.
Completeness honesty
A pack never calls itself complete merely because every reachable source returned a result. Known unknowns stay visible.
Identity visibility
The verification state is present without Trace implying a universal or autonomous identity decision.
Decision separation
Recommendations, factual observations and customer decisions are distinguishable in the case.
Delivery readiness
File structure, access, recipient, expiry and delivery method are checked before an approved transfer.
Retention closure
Credentials, working copies and final case materials have agreed revocation and deletion instructions.
Claim methodology
Product language advances only when evidence does.
The same discipline applied to a case should apply to Trace itself.
Implemented and currently usable, with an owner and evidence that supports the public wording.
Delivered through a defined human-operated process when scope and capacity are expressly accepted.
An illustrative interface, artefact or workflow used to test understanding—not customer proof.
A prioritised direction that has not reached a generally usable state and has no guaranteed date.
A claim or control requiring technical, security, operational or professional review before publication.
No sufficient evidence is available. The statement must not be presented as fact.
Sources
Official sources used for legal context.
The case method is Trace’s proposed operational model. Legal statements are grounded in primary EU materials.
Founding design partners
Test the method with a synthetic request.
The proposed Readiness Sprint maps up to three systems and rehearses the evidence method without accepting live request data through this website.