Operated function · records and disclosure
Most of the work is finding where the material is and putting it together — bounded, tedious, and the reason deadlines slip. Almost none of the risk is there. The risk is in what gets released, and that judgement should never leave your organisation.
The clock starts when the request arrives, which is frequently not when somebody notices it. A request can be made in ordinary language to any address a person happens to have, and it does not have to use the words your process is looking for — so the first days are often lost to it sitting in a general inbox as correspondence.
Then the search. The material is spread across systems that were never designed to be searched together, plus mailboxes, plus a shared drive, plus something a person keeps locally. Establishing what exists is most of the elapsed time and it is entirely bounded work: knowing where to look, looking there, and recording what was found and what was not.
Assembly follows, and volume is its own problem. A request for everything about a person can return thousands of items, most irrelevant, and somebody has to determine which are in scope before anyone can consider what is disclosable.
Redaction is where the risk concentrates and where the time pressure is worst, because it happens last, against a deadline the search has already consumed. Third-party information, legally privileged material, exemptions — each requires judgement, and judgement made in a hurry against a statutory deadline is exactly the condition that produces an over-disclosure.
And an over-disclosure cannot be undone. The person harmed is usually somebody who never made a request and does not know their information was in the file.
Locating and assembling material takes most of the statutory window, which means redaction and exemption decisions — the only genuinely risky part — are made under the greatest time pressure.
Reversing that order is the entire objective. If locating and assembling happen quickly and are complete, then the judgement is made with time to make it properly, by the person who should be making it, with the material in front of them rather than in an inbox at seven in the evening.
Locating is bounded and it is the right thing to delegate: a written source map of where each category of material lives, a search of each source, and a record of what was searched and what was found. The record is not administrative overhead — it is how you demonstrate that the search was adequate, which is what a regulator or a tribunal actually examines.
Recognising a request on arrival is the cheapest gain available. A clock that starts three days before anybody notices has already spent a meaningful share of the window, and identification is a classification problem rather than a legal one.
Scoping volume is bounded too: determining which items relate to the request is different from determining whether they may be disclosed, and only the second requires legal judgement.
What is never delegated is redaction and exemption. Whether third-party information may be released, whether an exemption applies, and whether privilege attaches are decisions with legal consequence for your organisation and irreversible consequence for people who are not in the room.
Time from arrival to recognition as a request — measured by elapsed hours before the clock was known to be running, against a baseline where recognition was incidental.
How the statutory window divides — measured by days spent locating and assembling versus days available for review, which is the ratio that determines risk.
Time available for redaction judgement — measured by days between assembled file and deadline, against your own baseline.
Demonstrable search adequacy — measured by requests carrying a record of every source searched including those that returned nothing, as a share of all requests.
Deadlines met — measured by responses issued within the statutory window, and the count of extensions relied on.
Where material actually turns out to live — measured by sources yielding relevant material by request type, which improves the source map for every future request.
any redaction, exemption, privilege or disclosure decision. Nothing here decides what may be released, applies an exemption, or determines that third-party information can be disclosed. Those judgements carry legal consequence for your organisation and irreversible consequence for people who never made a request, and they stay with your own reviewers.
Search runs against your systems through their documented interfaces, and the material stays where it is. Nothing is copied into a vendor store, because a records operation that created a second copy of everything it searched would have created a new disclosure surface of its own.
The source map is yours: written by your information governance team, versioned, owned. It is the artefact that makes a search demonstrable, and it improves with every request as sources that yield material are recorded.
Assembly is delivered into your review tooling, wherever your redaction actually happens, so the judgement is made in the environment your reviewers and your auditors already know.
Searching necessarily means reaching material about people who are not the requester, and that access is the most sensitive thing in this operation. It is scoped to the request, logged per item, and it does not create a copy outside your systems.
Nothing is disclosed by this operation. Assembly delivers to your reviewer; release is an act your organisation performs. There is no configuration in which material leaves for a requester without your review, and that is a structural property rather than a policy.
Every search is recorded including its negative results, because a source searched that returned nothing is evidence of adequacy and an unsearched source is a gap. Both matter and only one of them is visible without a record.
Operational access is not permission to train. Material searched in the course of a request — which by definition includes whatever your organisation holds about people — does not become material improving anything serving another organisation, in any form.
The boundary is the whole review: what is located and assembled versus what is decided. Your data protection officer will want it in writing, and it is short — everything up to and including assembly, and nothing at or beyond the redaction judgement.
The access question is the harder one, because searching means reaching material about people who are not the requester. That is scoped, logged and confined to your systems, and it should be examined on those terms rather than accepted on assurance.
Where an obligation attaches through a statute, a regulator or a data class, it is marked applicability-gated rather than presented as standing — the statutory regimes here differ substantially by jurisdiction and by request type.
One trailing period of closed requests — read-only, nothing searched live and nothing disclosed — measuring recognition delay and how the statutory window divided between locating, assembling and reviewing.
The observation phase produces the ratio that governs risk: how much of the statutory window was consumed before the material reached a reviewer. Where that is most of it, every redaction judgement in the period was made under avoidable time pressure, and that is the finding.
It also produces the recognition delay, which is usually the cheapest thing to fix and requires no operated search at all — a channel being watched properly can return days to every request.
If you continue, the first delegation is recognition and clock tracking, then locating and assembly on one request type, with redaction untouched and the source map written before the first search runs.
Agreed, and none are made here. The boundary is stated in the hero rather than in a footnote: everything up to assembly is in scope, and redaction, exemption, privilege and release are not. There is no configuration in which material reaches a requester without your review. If a vendor offers to make redaction decisions for you, they are offering to take on your liability with none of your context.
It does, and that is the sharpest thing on this page. It is scoped to the request, logged per item, and confined to your systems with no copy created outside them. It should be examined on those terms rather than accepted on assurance, which is why the logging model is offered for review before any live search. Where your assessment is that the access itself is unacceptable, the honest scope is recognition and clock tracking only — which still returns days.
That is the normal condition and it is precisely why locating consumes the window. The source map makes it explicit rather than remembered, and it improves with each request as sources that actually yield material are recorded. Where material lives somewhere that cannot be searched systematically, that is recorded as a known gap in the search record — which is a better position than an unrecorded one, because adequacy is what gets examined.
Meeting the deadline and having time to review are different things, and the second is where the risk lives. The measurement worth taking is how many days remained between the assembled file and the deadline across your last period. If reviewers routinely had a week, your process is working. If they routinely had an afternoon, the deadlines were met and the judgements were made under exactly the pressure that produces an over-disclosure.