Job legal-requests-hidden-in-support-email-spotted-and-dated · revised 12 October 2026
Spot data-access, deletion and opt-out requests in support email, with a due date
Messages that are or may be a data-access, deletion or opt-out request are flagged to a named person with the type and a due date stamped.
You might be seeing
- Data requests arrive in ordinary support email
- Staff reply to them as normal questions
- Nobody tracks the due date
No passwords, keys, card details or admin invites needed to start.
What usually happened
A request for a person's data needs no special wording and can come by any channel, including social media, so it hides in ordinary support messages. In the UK the response is due within one month, and staff must be able to recognise one.
Who it’s for: Owner or support lead whose staff do not recognise a data-access, deletion or opt-out request when it arrives.
Usually starts when: A customer wrote "send me everything you hold on me" to the general inbox, and nobody knew it started a one-month clock.
The result: Messages that are or may be a data-access, deletion or opt-out request are flagged to a named person with the type, the received date and a due date stamped. A person decides everything, and we do not fulfil or answer requests.
Check whether this job fits
Answer these without sending chats, tickets, files or logins. Nothing is submitted unless you choose to contact us.
What you get
- The request-type list and due-date rules
- The alert route
- The 100-message test and results
- A list of misses and false alarms
Included
- One inbox or help desk, text channels only
- A request-type list and rules with due-date logic you confirm
- An alert route to one named person
- A test of 100 messages, 20 of them planted variants, in a sandbox
- The received date and due date on every flag
Not included
- Answering or fulfilling any request
- Legal advice or deadlines for regimes you have not named
- Locating or exporting a person's data
- Replies to the customer
- Voice calls
- Cancel, legal-threat, chargeback, safety and press messages: see the cancel and legal flags job
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
All 20 planted requests are flagged, including "send me everything you hold on me" and "delete my account and my data"; 8 were chosen by you and unseen by us until the final run. One missed request fails the whole test. These planted messages are a smoke test, not a measured catch rate on real messages.
Evidence: The 20 planted messages with results and the held-back marker.
No more than 4 of 80 ordinary messages are flagged (5%); 30 of the 80 were chosen by you and unseen by us until the final run, and the cap applies to all 80.
Evidence: The false-alarm list.
Each flag carries the received date and a due date computed from the deadline you stated.
Evidence: Sample flags beside the deadline table.
A person decides everything: no flag sends, deletes or replies.
Evidence: The alert log and your inbox's sent folder for the test period.
Sign-off. Your receiving person reads the results and the false-alarm list and you sign off in writing. Payment follows sign-off.
If it fails. If a planted request is still missed after one retest on 10 new planted variants you write (all 10 must be flagged), we hand over the open misses and you decide whether to stop or re-quote.
When it fits, and when we stop
It fits when
- One inbox or help desk with written messages
- A named person who receives and handles flags
- You tell us which regimes and deadlines apply to you
We stop and tell you if
- You want us to fulfil or answer requests
- You want legal advice
- Nobody is named to receive flags
What could go wrong
The rules are tested in a sandbox and nothing in your live inbox changes until you apply them. Removing them restores the old behaviour.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| A request is missed and its deadline passes | All 20 planted requests must be flagged; a miss fails the whole test. The tool does not replace training your staff to recognise one. |
| A wrong due date is stamped | Dates use the deadline you state for each type, shown with the received date for checking. |
| The flag is read as legal advice | Every flag says it is an alert for a person to decide, not advice or a conclusion. |
| Message text carries instructions | Messages are treated as untrusted text and the flagger has no tools beyond one alert. |
A separate automated reviewer checks the misses, the false alarms and the due dates before hand-over, and your receiving person on your side marks the sample and decides what goes live. No human supervisor is included unless your agreement names one. At launch the work is largely automated, and we say so.
How we deliver
We arrange the work and independent review, then show you the result against the agreed checks. You keep authority over your systems.
- Agree request types, deadlines, the receiving person and pass marks in writing
- Write the rules, including variants such as "send me everything you hold"
- Run the 100-message test; record every flag with type and dates
- List every miss and every false alarm
- Independent automated review; your person checks the false alarms
- Hand over the rules and alert route for you to switch on
This is a one-off job, not emergency cover or a subscription. We confirm eligibility, the total price, a start window and a delivery date before you accept. Work starts only after agreed inputs, secure access and any needed permissions are in place. Model usage for our build and tests is included in the price; charges on your own platform account, including per-conversation fees after go-live, are yours. An enquiry creates no charge or booking.
Need to keep it working?
Discuss a monthly re-test with fresh planted variants.
Ongoing work is separately scoped and quoted: no monitoring, response-time guarantee or automatic subscription is included in this job.
Explore an ongoing managed lane, or mention the responsibility you need in your enquiry.
What you can check
This is a new service. We have not delivered this job for a client yet.
Other ways to get this done
- Train every support person with a one-page card on what a data request looks like. The UK regulator says staff should be able to recognise one. ico.org.uk
Questions
Does it answer requests?
No. It tells a person a request has arrived and when it is due.
Does it replace training my staff?
No. The regulator expects staff to recognise requests. This is a second check.
Which countries are covered?
The deadlines are the ones you state. We do not decide them.
Send an enquiry
Send us
- Your inbox or help desk and rough monthly volume
- The country or countries your customers are in
- Who handles requests today
- No customer data, logins or keys in the first enquiry
Later, once you agree
- A redacted sample of 80 ordinary messages, 30 of them chosen by you and unseen by us until the final run, and the types of request you want caught
- A sandbox or test inbox and a named receiving person
- The deadline for each type, stated by you or your adviser
- 8 of the 20 planted variants chosen by you and unseen by us until the final run
You keep the inbox and every login. We work in a sandbox or on a redacted sample, alert only a person you name and never reply to anyone or touch the data requested.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “legal-requests-hidden-in-support-email-spotted-and-dated” as the subject.