The Open Subject Access Standard (OSAS)

What OSAS is

A subject access request is when a person asks an organisation for a copy of the data it holds about them. The law says the organisation must answer. The law says little about how good that answer should be, and little about how easy the request should be to make in the first place. OSAS fills that gap. It sets out testable criteria, grouped into domains, that cover the whole journey: finding out how to make a request, making it, the search the organisation runs, what the organisation withholds, and how the organisation delivers the result.

• OSAS scores the whole handling of a request, from finding the organisation’s privacy notice and how to make a request, to the data the organisation provides.
• It sets 3 cumulative conformance levels: Level 1, Level 2, and Level 3.
• It scores what an organisation shows, not what it claims. Where nobody outside can check whether the answer is right, OSAS scores whether the organisation shows its working.
• The criteria, the assessment method, and a fully worked example are published in full.
• It is free to read, free to use, and openly governed.

Conformance levels

OSAS sets 3 levels. Each level includes the one below it, so a response reaches a level only when it meets every criterion at that level.

• Level 1. The person receives a response, on time, that covers what the law demands and that can be read.
• Level 2. The person can check the response and act on it. The person knows what was searched, what was withheld and on what ground, and what to do next.
• Level 3. The response is built for the person who asked, rather than for the organisation that answers.

No level means ‘legally compliant’. The levels describe what a response does for the person.

How the standard is organised

OSAS has 3 layers, so the parts that stay fixed are held apart from the parts that change often.

• Domains and criteria. 8 domains, each holding a short set of numbered, testable criteria. The numbers stay fixed, so criterion D3 means D3 in every edition.
• Levels. Each criterion sits at one of the 3 levels.
• Techniques. A separate, living document shows how to meet each criterion. The techniques change as practice moves, and the criteria stay the same.

The domains are:

• A. Finding and Making a Request
• B. Acknowledgement and Timeline
• C. Identity Verification
• D. Completeness and Scope
• E. Supplementary Information
• F. Intelligibility
• G. Format and Delivery
• H. Redaction and Exemptions

Assessing a response

SARA, the Subject Access Response Assessment, is how the handling of a subject access request is scored against OSAS. It is a single instrument with 2 uses.

• An organisation runs it on itself to make a conformance claim.
• Anyone else runs it on a request they made, to score how the organisation handled it.

SARA scores each criterion 2, 1, 0, or not applicable. It reports a figure for each domain and one figure overall, alongside the highest level fully met.

Reference material

OSAS comes with the material an assessor needs to apply it, not the criteria alone.

• A reference response pack. A single worked example at the top level.
• The techniques document. How to meet each criterion.
• A machine-readable schema. For the manifest that accompanies a response, and for assessment records, so any score can be reproduced.
• A calibration set. 10 scored responses that an assessor matches before their scores count, so 2 people score the same response the same way.

Versions

This is OSAS 1.0. Every version keeps a permanent page and a dated record of each change. A point release adds a criterion or clarifies wording. Only a major release moves a criterion between levels or removes one, because either change alters what an existing claim means.

Who maintains OSAS

The Centre for Digital Consumers publishes and maintains OSAS. The criteria are public, and the record of changes is public. Anyone who thinks a criterion or a score is wrong can report it through the contact page.