Job compliance-dsar-runbook-and-clock-tested-on-a-dummy-request · revised 12 October 2026
Get a subject access request runbook and deadline tracker, tested on a dummy request
A runbook, intake form, deadline tracker and search plan for subject access requests, proved end to end on a synthetic request. The legal calls stay with your named handler.
You might be seeing
- A request has arrived and nobody knows who owns it or when it is due
- You do not know which systems hold a person's data
No passwords, keys, card details or admin invites needed to start.
What usually happened
A subject access request has a statutory clock, usually one month, and a search that must be reasonable and documented. A company with no process may handle its first request in a hurry and miss the deadline. Redaction and exemption decisions are legal calls, so the process has to hand them to a named person.
Who it’s for: HR lead, office manager or director of a UK company with no written process for subject access requests.
Usually starts when: The first request arrives, or a customer or insurer asks what your process is.
The result: You get a runbook, an intake form, a deadline tracker and a search-plan template, proved on a synthetic request. The test logs the dummy request, sets the clock, fills the search plan, and each system owner confirms their search step. Exemption and redaction decisions stay with your named handler.
Check whether this job fits
Answer these without sending files or logins. Nothing is submitted unless you choose to contact us.
Checks you can run yourself
Work out one deadline
Pick a date and work out when a response would be due one month later, using the ICO guide.
Look for: Whether your handler gets the same date as the tracker. Differences are what the test checks.
What you get
- The runbook, intake form, tracker and search-plan template
- The system list with owners
- The dry-run record
Included
- A written runbook from receipt to reply, with the clock rules taken from the ICO guidance, including when the clock starts late or pauses for a clarification. The rule for counting month ends and non-working days is agreed in writing with your handler
- An intake form, a deadline tracker (a sheet or your own tool) and a search-plan template
- A list of your systems that hold personal data, with an owner and a search step for each
- A dry run on a synthetic request, recorded
- Scripts work out the dates; the language model drafts the runbook text from the ICO guidance and your system list
Not included
- Handling a live request
- Deciding exemptions, redactions or what to disclose
- Legal advice, or any statement that you comply with data protection law
- Contacting the requester
- Deciding identity checks for a real person
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
On 12 test dates including month ends and a leap day, the response date in the tracker equals the date your handler calculates from the ICO guidance, for the standard month and for a two-month extension.
Evidence: The test dates with your handler's dates and the tracker's dates side by side. One difference fails the test.
The dummy request is logged, the clock is set, and every field of the search plan is filled with synthetic data. Each system owner confirms in writing that their search step can be carried out.
Evidence: The dry-run record and the owners' confirmations.
A person who did not write the runbook follows it alone on the dummy request and needs no step explained.
Evidence: The follower's notes on any step that was unclear.
No personal data of a real person appears in any test file.
Evidence: The test files, read by your handler.
Sign-off. Your named handler inspects the test results and the delivered output, and signs off in writing. Payment follows sign-off.
If it fails. If the agreed tests do not pass, you do not pay for this fixed scope. We hand over what we found and agree whether to stop or re-quote; no surprise work.
When it fits, and when we stop
It fits when
- A named handler on your side owns requests
- You can list the systems that hold personal data
- Each system owner can confirm a search step in the dry run
We stop and tell you if
- A live request is already open (it is not ours to handle; the runbook can follow)
- The request is tied to a dispute or a solicitor's letter
- Nobody will own the handler role
What could go wrong
The job reads files you send and writes a report or draft; it changes nothing in your systems, so there is nothing to undo. Our copies of your files are deleted when the job ends.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| The runbook is read as legal advice | The runbook says exemption, redaction and identity decisions belong to your handler. It quotes the ICO guidance and gives no legal opinion. |
| The tracker shows a wrong deadline | The tracker is tested on 12 dates your handler checks against the ICO calculation guidance. |
| Real personal data enters the test | The dry run uses an invented person and invented documents only. |
| Your files pass through an AI model provider | The written agreement names the provider type, its country and how long it keeps data before you send anything. Entry jobs use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the job ends. |
A separate automated reviewer checks every runbook step against the ICO guidance before it reaches you. Your named handler checks every date and owns every legal decision. No human supervisor is included unless your agreement names one, and at launch the work is largely automated.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree the handler, systems, date-counting rule and dry-run date
- Draft the runbook, intake form and tracker from the ICO guidance
- Test the tracker on 12 dates, including month ends and a leap day
- A separate automated reviewer checks every step cites the guidance
- Run the dry run: your handler logs a synthetic request and owners confirm
- Hand over the files and the dry-run record
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept. Work starts only after agreed inputs, secure access and any needed permissions are in place. Hosting, supplier and platform charges are excluded unless the written quote includes them. An enquiry creates no charge or booking.
Need to keep it working?
Want help with the first live request? A separate search-index job and a redaction-proposals job are available.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Follow the ICO's own guide to subject access, which sets out the steps and the clock. ico.org.uk
- Ask your solicitor or data protection adviser for a template process.
Questions
Do you handle a live request?
No. This job builds and tests the process on a dummy request. A live request stays with your handler.
Do you decide what to redact or withhold?
No. Those decisions belong to your handler and must be documented. The runbook shows where they are made.
Is the deadline always one month?
The ICO guide says one month, extendable by up to two more months for a complex request. Your handler confirms each date.
Send an enquiry
Send us
- Roughly how many systems hold personal data
- Who would be the handler
- Whether you have had a request before. No real requests or personal data in the first enquiry
Later, once you agree
- A list of your systems with an owner for each
- A named handler and a second contact
- Time for each system owner to confirm a search step in the dry run
You keep your systems, your data and every decision. We work from the system list you give us and write the runbook and tracker. We never see a real request or any personal data, and we have no login to your systems.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “compliance-dsar-runbook-and-clock-tested-on-a-dummy-request” as the subject.