Test the subject access journey from request to response.
Run authorised subject access request scenarios with synthetic identities, record what happens at each step and review the evidence against the framework your privacy team defines.
Move from written expectation to observable evidence.
A written procedure cannot show how a real request is acknowledged, identity-checked, progressed and answered. A controlled test records the customer-facing journey as it actually happens.
Run the work as a controlled assessment programme.
1. Define a fixed DSAR scenario and questionnaire before fieldwork starts.
Define a fixed DSAR scenario and questionnaire before fieldwork starts.
2. Record acknowledgement, identity-check steps, dates and response milestones as structured answers.
Record acknowledgement, identity-check steps, dates and response milestones as structured answers.
3. Attach supported screenshots or PDF correspondence and route the completed submission through independent review.
Attach supported screenshots or PDF correspondence and route the completed submission through independent review.
Brief → fieldwork → review → controlled release.
1. Create a synthetic test identity and an authorised request brief.
Create a synthetic test identity and an authorised request brief.
2. Submit the request through the channel in scope and record each observable step.
Submit the request through the channel in scope and record each observable step.
3. Reviewer checks answers and evidence before the result is released to the authorised client audience.
Reviewer checks answers and evidence before the result is released to the authorised client audience.
Keep the evidence attached to the result.
The evidence trail can include questionnaire answers, timestamps, screenshots and PDF correspondence supported by the current platform. RetailHawk records observations; it does not decide whether a response is legally compliant.
Data-rights test journey
This diagram explains the operating sequence only; it is not a product screenshot.