One month, a copy, and the recipients by name. Subject access tooling is mostly bought against the easiest of the three.

The clock is one month. It has been one month since 25 May 2018, nothing about it has changed, and it is worth saying so before anything else, because subject access is sold as though something had.

Three sentences of the regulation set the work. Article 12(3): answer without undue delay and in any event within one month of receiving the request, with an extension of two further months available where the request is complex or where there are a number of them — but the extension, and the reasons for it, have to reach the person inside the first month. That is the part people miss. The extension is not relief discovered in week six. It is a decision taken in week three by someone who already knows how bad the search is going to be.

Article 15(3): provide "a copy of the personal data undergoing processing". In Case C-487/21 the Court read that as a faithful and intelligible reproduction of the data, with whole documents reproduced only where that is what it takes to make them intelligible. So not a database export, and not the file either.

Article 15(1)(c), read with Case C-154/21: where the person asks who the data went to, the answer is the recipients by name, not the categories of recipient, unless naming them is impossible or the request is manifestly unfounded or excessive.

There are further limbs — the retention period, the source, the automated decision-making disclosure, the Article 15(4) limit where another person's rights are engaged — and they are in Article 15 where anyone can read them. The three above are the three that a tool either does or does not do.

What the regulation declines to say

More useful than any of that is the list of things the text does not contain.

There is no format. Nothing says the copy is a PDF, a portal, a spreadsheet or a bundle of screenshots, and Recital 63's suggestion of secure remote access is a suggestion. There is no definition of "manifestly unfounded or excessive" beyond the repetitive character named in Article 12(5), and the burden of demonstrating it sits with the controller — a burden nobody has designed a record for. And there is not one word about a firm of solicitors sending forty requests in a week on one template, for forty people who each signed something. That is now a substantial share of the volume at consumer-facing firms.

The bank this page is written for

One and a half million retail customers. Nine systems that hold personal data as their job, and an unknown number that hold it incidentally. Two hundred and forty thousand hours of retained call recordings, kept because a different regulator asked for them. Free-text notes in the customer system, typed by branch staff over eleven years, in two languages. Sixty-one requests in the busiest month last year, against nineteen a month two years before, fourteen of them from one law firm on one template. Two people do privacy, and neither does only privacy.

It is a composite, built from four firms that would not want to be named, and the composite is the honest form: a named bank would let you match the answer to the logo instead of to the constraints, and the constraints are the argument.

The binding constraint is not the clock. It is that nobody can say, in an afternoon, everywhere a named customer appears.

The method, and the disclosure that goes with it

This page is the method. It is not the verdict.

Nothing has been put through this brief yet. Until it has, ranking products here would be a comparison of datasheets, which is marketing with a byline on it. So the page states the brief, the criteria, the weights, the categories an answer can fall into and the specific things a test has to measure to separate them. The ranked verdict is published on this page when the testing is done, and the page is revised rather than replaced.

No product is named below, and that costs the page a reader who came for four names to put on a slide. Naming them next to criteria they have not been measured against produces the implied ranking the page has not earned, and readers are right to read a list as a ranking.

On the wall: sponsorship is sold on this site, and a live campaign from anyone discussed here would be declared here, in this voice, and again next to the vendor. The campaigns file was empty when this was filed, so there is nothing to declare, and that will not stay true.

Three criteria that decide it, and three that decide the margin

The weights are the argument. Anyone can list criteria.

Recall across unstructured data, 25. Mailboxes, free text, call recordings, the shared drive nobody owns. Not whether the tool can search them — whether it finds a named person in all of them, and admits what it could not reach.

Third-party data and redaction, 20. Article 15(4) is a limit, not a licence to withhold, and the practical question is whether another customer's name survives into the pack. In a call recording, that is a transcription problem before it is a redaction problem.

Recipients by name, 15. Producing actual recipients for one named customer requires lineage the bank does not currently have. Most tools answer this with a field someone types into once a year.

Then the three that decide the margin rather than the outcome. Evidence of the clock, 15: whether receipt, extension and dispatch can be proved to a supervisor a year later without reconstructing a mailbox. Exit, 15: what the tool takes with it, and whether the connectors and the redaction rules were rent or purchase. Five-year cost including internal hours, 10, which is the number left out of the business case and paid anyway.

A polished pack assembled from six of the nine systems is a well-presented breach of Article 15.

Recall outranks everything because it is the only criterion whose failure is invisible.Precision failures arrive as redaction cost, which is annoying and visible. Recall failures arrive as a complaint two years later from someone who knew the data existed.

Five ways to answer, one of which is to carry on

Carry on. A mailbox, a spreadsheet, a named person and a fixed weekly hour. Below roughly thirty requests a month this is often correct, its exit cost is zero, and it scores badly only on evidence of the clock. Leaving it off a shortlist is how a firm buys a platform to fix a rota.

A module in something already bought. The privacy add-on to the customer system, the archive product, or the data catalogue. Cheapest to buy and to staff. Sees exactly as far as its parent product sees, which at this bank is about a third of the problem.

Dedicated request management. Workflow, deadlines, templates, an audit trail. Strong on the clock, strong on evidence, and largely silent on discovery — it orchestrates a search it does not perform. This is the category most often bought and it is bought against the criterion worth 15, not the one worth 25.

An eDiscovery-derived platform. Built for litigation, repurposed. The only category with a serious answer to unstructured recall and to redaction at volume. Expensive, priced per matter or per gigabyte in ways that punish a steady trickle of small requests, and operationally heavy for two part-time people.

Outsource the handling. A legal services provider runs the process and returns the pack. Directly addresses the headcount constraint, which is the real one. Sends the bank's entire customer record to a third party as routine, and its exit is a staffing problem wearing a contract.

What fell out before testing: consent management platforms, which solve a different problem out of the same budget; anything whose demonstration used a single structured database; and two propositions that could not say where the assembled pack is stored, which is a disqualification rather than a low score.

What the testing has to measure

Stated now, so the verdict can be checked against it later.

Three seeded requests of known difficulty, run end to end by the bank's own two people against the documentation, timed from receipt to dispatch. A recall count: plant one synthetic customer across all nine systems, the mailboxes and three hundred hours of calls, then count what each option misses and what it admits to missing. A third-party count: how many other named people survive into the finished pack. The recipients question, for one customer, answered or not answered. The forty-request template from one firm, run as a batch. And the refusal path — whether the tool can build the record that an Article 12(5) refusal would have to be defended on.

Two things will not be tested. Language coverage beyond the two the bank uses, because we cannot judge a transcription model in a language we do not read. And images or CCTV, which is not this brief and deserves its own.

Who should ignore this page

A controller under about thirty requests a month, where the first option plus a diary reminder is the answer and the procurement is the distraction. A firm whose requests arrive from employees rather than customers, where the volume is lower, the data is concentrated and the litigation risk is a different one. And anyone with a supervisory complaint already open, because that changes the brief from what should we buy to what can we evidence by the date in the letter.

What would make us rewrite it

An interoperable format for the copy — a schema rather than a suggestion — would move weight off recall and onto exit, because portability would start to mean something. A judgment reading Article 15(4) more permissively would cut the redaction weight and change the ranking outright. And if the call recording archive is retired on the retention schedule rather than renewed, a quarter of the score is measuring a system that will not exist in three years.

The testing starts in November. The verdict goes here.