The Open Subject Access Standard 1.0
- Status
- Draft
Abstract
OSAS is an open standard for how an organisation handles a subject access request, from the ease of making one to the quality of the answer. It sets out testable criteria, grouped into domains under five principles, at three cumulative conformance levels: Level 1, Level 2, and Level 3.
Status of this document
This is a draft of version 1.0, published for comment. The criteria and their numbers may still change before 1.0 is final, so do not yet rely on them as stable. To comment on a criterion, contact us. For a plain-English introduction to OSAS, see the overview. The criteria are also published as JSON.
Reachable
Finding and Making a Request
A1 A Findable Privacy Notice
Level 1
Every page of the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made.'s website links to its privacy noticeThe public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights..
A2 A Signposted Route
Level 1
The privacy noticeThe public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights. explains how to make a subject access requestA request by the person to the organisation to exercise the right of access. Shortened to the request throughout this standard., including where to send it.
A3 No Account Required
Level 1
Making a request does not require creating an account where the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. does not already hold one.
A4 No Mandated Route
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. does not require a subject access requestA request by the person to the organisation to exercise the right of access. Shortened to the request throughout this standard. to be made through one particular routeA means by which the person can make a request, such as an email address, a form, a postal address, or a feature within an account., such as a single form or online portal.
A5 A Request in Any Wording
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. treats a request as valid whatever wording it uses.
A6 A Verbal Request
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. treats a request made verbally as valid.
A7 A Named Contact
Level 2
The privacy noticeThe public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights. names a data-protection contactThe person or team the organisation identifies as responsible for data-protection matters, including requests. Where the organisation has appointed a Data Protection Officer, the data-protection contact is that officer. and a direct way to reach them.
A8 A Choice of Routes
Level 2
At least two routesA means by which the person can make a request, such as an email address, a form, a postal address, or a feature within an account. exist to make a request, one of which is an email address for subject access requestsA request by the person to the organisation to exercise the right of access. Shortened to the request throughout this standard. or the data-protection contactThe person or team the organisation identifies as responsible for data-protection matters, including requests. Where the organisation has appointed a Data Protection Officer, the data-protection contact is that officer..
A9 A Proportionate Request Form
Level 2 (judgement)
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. provides a request formA form the organisation provides for making a request., it asks for nothing beyond what is needed to identify the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. and locate their data.
A10 A Request Made on Someone's Behalf
Level 2
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. accepts a request made by someone the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. has authorised to act for them.
A11 The Right Explained
Level 3
The privacy noticeThe public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights. explains what the right of accessThe person's right to obtain from the organisation confirmation that their personal data is being processed, a copy of that data, and the supplementary information about the processing. It is set out in Article 15 of the UK GDPR. lets a person do, not only that the right exists.
A12 No Discouragement
Level 3 (judgement)
No step in making a request presents a message or question that urges the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. to reconsider, narrow, or withdraw it.
Responsive
Acknowledgement and Timeline
B1 A Response Within the Time Limit
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. is provided within one month of the request, or within an extended time limitThe period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows. the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. has notified.
B2 An Extension Notified in Time
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. extends the time limitThe period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows., it tells the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. within one month of the request.
B3 An Extension Explained
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. extends the time limitThe period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows., it states why the extensionAn addition to the time limit that the law allows where a request is complex, or where the organisation has received a number of requests from the same person. An extension can be up to two further months. is needed.
B4 Acknowledgement of Receipt
Level 2
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. confirms to the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. that it has received the request.
B5 A Stated Response Date
Level 2
The acknowledgementThe organisation's confirmation to the person that it has received the request. states the date by which the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. will respond.
Identity Verification
C1 No Verification on an Identified Route
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. does not request identity verificationSteps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information. where the request comes through a routeA means by which the person can make a request, such as an email address, a form, a postal address, or a feature within an account. that already identifies the personThe identified or identifiable individual the personal data is about, who is exercising the right of access..
C2 Proportionate Verification
Level 1 (judgement)
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. requests identity verificationSteps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information., it asks only for what is necessary to confirm the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s identity.
C3 Verification Explained
Level 2
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. requests identity verificationSteps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information., it states why the verification is needed.
C4 The Effect on the Time Limit Stated
Level 2
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. requests identity verificationSteps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information., it states how this affects the time limitThe period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows. for responding.
C5 Verification Data Not Retained
Level 3
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. states that identity information provided for verification is used only to confirm identity and is not kept afterward.
Complete
Completeness and Scope
D1 Confirmation of Processing
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states whether or not the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. processes the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly..
D2 A Copy of the Data
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. processes the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. includes a copyThe reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it. of it.
D3 The Systems Searched
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states which systems or recordsA single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database. the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. searched for the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly..
D4 The Period Searched
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the date range the searchThe steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike. covered.
D5 Whether the Search Was Limited
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states whether or not the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. limited the scope of its searchThe steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike..
D6 A Limit on the Search Explained
Level 2
Where the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states that the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. limited the scope of its searchThe steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike., it states what was not searched, and why.
D7 A Request Not Narrowed Without Agreement
Level 2
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. asks the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. to specify what they want, it does not treat the request as withdrawn or narrowed if the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. does not reply.
D8 Data Held on the Organisation's Behalf
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states whether the searchThe steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike. covered personal dataInformation relating to the person, from which they can be identified directly or indirectly. held on the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made.'s behalf by another organisation.
D9 Unstructured Records Included
Level 3
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states whether the searchThe steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike. covered unstructured recordsA single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database., such as emails and documents, and not only structured databases.
Supplementary Information
E1 The Purposes
Level 1 (judgement)
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the purposes for which the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. processes the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly..
E2 The Categories of Data
Level 1 (judgement)
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the categories of the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly. that the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. processes.
E3 The Recipients
Level 1 (judgement)
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the recipientsA person or organisation to whom the organisation discloses the person's personal data., or categories of recipientA person or organisation to whom the organisation discloses the person's personal data., to whom the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. has disclosed or will disclose the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly..
E4 The Retention Period
Level 1 (judgement)
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states how long the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. will keep the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly., or the criteria it uses to decide.
E5 The Person's Other Rights
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s rights to rectification, erasure, restriction, and objection.
E6 The Right to Complain
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states that the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. can complain to the Information Commissioner's Office.
E7 The Source of the Data
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. did not collect the personal dataInformation relating to the person, from which they can be identified directly or indirectly. from the personThe identified or identifiable individual the personal data is about, who is exercising the right of access., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states any available information about its source.
E8 Automated Decision-Making
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states whether the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. makes solely automated decisions about the personThe identified or identifiable individual the personal data is about, who is exercising the right of access., including profiling.
E9 The Logic Explained
Level 1 (judgement)
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. makes solely automated decisions about the personThe identified or identifiable individual the personal data is about, who is exercising the right of access., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. gives meaningful information about the logic involved.
E10 The Consequences Explained
Level 1 (judgement)
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. makes solely automated decisions about the personThe identified or identifiable individual the personal data is about, who is exercising the right of access., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the significance of those decisions and their likely consequences.
E11 Safeguards for Transfers Abroad
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. transfers the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly. outside the UK, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the safeguards it relies on for the transfer.
E12 Recipients Named
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. names the actual recipientsA person or organisation to whom the organisation discloses the person's personal data. of the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly., not only categories of recipientA person or organisation to whom the organisation discloses the person's personal data., unless naming a recipientA person or organisation to whom the organisation discloses the person's personal data. is not possible.
E13 Written for the Person
Level 2 (judgement)
The supplementary informationThe information about the processing that the response includes alongside the copy of personal data: the purposes, the categories of data, the recipients, the retention period, the person's rights, the source of the data, and any automated decision-making. describes how the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. processes the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s own data, not only what its general privacy noticeThe public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights. says.
E14 A Specific Retention Period
Level 3
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. gives a retention period for the personThe identified or identifiable individual the personal data is about, who is exercising the right of access.'s personal dataInformation relating to the person, from which they can be identified directly or indirectly., rather than only the criteria for deciding one.
Intelligible
Intelligibility
F1 Codes and Terms Explained
Level 1
Where the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. or the copyThe reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it. uses codes, abbreviations, or technical terms, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. explains what they mean.
F2 What Each Part Is
Level 1
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. identifies what each part of the copyThe reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it. is.
F3 Organised to Navigate
Level 2 (judgement)
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. is organised so the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. can find their way through it, rather than presented as an undifferentiated bundle.
F4 Clear to a Child
Level 2 (judgement)
Where the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. is addressed to a child, it uses language the child can understand.
F5 A Guide to the Response
Level 3
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. includes a short guide to what it contains and how it is arranged.
F6 Plain Language
Level 3 (judgement)
A person without specialist knowledge of the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made.'s systems or of data-protection law can understand the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing..
Format and Delivery
G1 Provided Free
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. provides the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. free of charge.
G2 Electronic by Default
Level 1
Where the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. made the request by electronic means, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. is provided in a commonly used electronic form, unless the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. asked for another form.
G3 Delivered Securely
Level 1
The organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. delivers the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. by a means that protects it from being read by anyone other than the personThe identified or identifiable individual the personal data is about, who is exercising the right of access..
G4 A Usable Format
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. is provided in a format the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. can open and reuse with commonly available software, not as images of the personal dataInformation relating to the person, from which they can be identified directly or indirectly. or a file locked against reuse.
G5 No Barrier to Collection
Level 2
Receiving the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. does not require creating an account where the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. does not already hold one, or using one particular portal.
G6 An Accessible Format on Request
Level 2
Where the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. needs the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. in an accessible format, the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. provides it in that format.
G7 Accessible by Default
Level 3
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. meets recognised accessibility standards, so a person using assistive technology can read it without having to ask for an alternative.
Accountable
Redaction and Exemptions
H1 Refusal Explained
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. refuses a request in whole or in part, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the reasons.
H2 How to Challenge a Refusal
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. refuses a request in whole or in part, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. tells the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. they can seek a remedy from the Information Commissioner's Office or a court.
H3 Redaction Shown
Level 1
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. redacts information from the copyThe reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. shows that something has been redacted.
H4 The Ground Stated
Level 2
For each redactionThe removal or obscuring of information from the copy, such as another person's data or material an exemption covers., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states the ground relied on.
H5 Redaction Limited to What Is Withheld
Level 2 (judgement)
Each redactionThe removal or obscuring of information from the copy, such as another person's data or material an exemption covers. covers only the information withheld, and not the surrounding text, page, or recordA single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database. that contains it.
H6 A Record Withheld in Full Explained
Level 2
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. withholds a recordA single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database. in full under an exemptionA legal ground on which the organisation may withhold some personal data from the response., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states why no part of it could be disclosed.
H7 A Charge or Rejection Justified
Level 2
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. charges a fee, or rejects the request as manifestly unfounded or excessive, the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states why.
H8 How to Complain to the Organisation
Level 2
The responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. states how the personThe identified or identifiable individual the personal data is about, who is exercising the right of access. can complain to the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. about it.
H9 The Reason Explained
Level 3 (judgement)
Where the organisationThe body that determines the purposes and means of processing the personal data, and to which the request is made. relies on an exemptionA legal ground on which the organisation may withhold some personal data from the response., the responseWhat the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing. explains why it applies to the redacted data, not only which exemptionA legal ground on which the organisation may withhold some personal data from the response. it is.
Glossary
Each term below has one meaning across the whole standard, and every criterion uses it verbatim. Where a term has a common name in law or practice, that name is noted but not used in the criteria.
- acknowledgement
- The organisation's confirmation to the person that it has received the request.
- copy
- The reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it.
- data-protection contact
- The person or team the organisation identifies as responsible for data-protection matters, including requests. Where the organisation has appointed a Data Protection Officer, the data-protection contact is that officer.
- exemption
- A legal ground on which the organisation may withhold some personal data from the response.
- extension
- An addition to the time limit that the law allows where a request is complex, or where the organisation has received a number of requests from the same person. An extension can be up to two further months.
- identity verification
- Steps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information.
- the organisationalso known as controller
- The body that determines the purposes and means of processing the personal data, and to which the request is made.
- the personalso known as data subject
- The identified or identifiable individual the personal data is about, who is exercising the right of access.
- personal data
- Information relating to the person, from which they can be identified directly or indirectly.
- privacy notice
- The public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights.
- recipient
- A person or organisation to whom the organisation discloses the person's personal data.
- record
- A single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database.
- redaction
- The removal or obscuring of information from the copy, such as another person's data or material an exemption covers.
- request form
- A form the organisation provides for making a request.
- the response
- What the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing.
- the right of access
- The person's right to obtain from the organisation confirmation that their personal data is being processed, a copy of that data, and the supplementary information about the processing. It is set out in Article 15 of the UK GDPR.
- route
- A means by which the person can make a request, such as an email address, a form, a postal address, or a feature within an account.
- search
- The steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike.
- subject access requestalso known as SAR, DSAR
- A request by the person to the organisation to exercise the right of access. Shortened to the request throughout this standard.
- supplementary information
- The information about the processing that the response includes alongside the copy of personal data: the purposes, the categories of data, the recipients, the retention period, the person's rights, the source of the data, and any automated decision-making.
- time limit
- The period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows.