{
  "$schema": "https://www.digitalconsumers.org.uk/osas/1.0/osas.schema.json",
  "metadata": {
    "standard": "OSAS",
    "title": "The Open Subject Access Standard",
    "version": "1.0",
    "status": "draft",
    "url": "https://www.digitalconsumers.org.uk/osas/1.0",
    "licence": "CC-BY-4.0",
    "licenceUrl": "https://creativecommons.org/licenses/by/4.0/"
  },
  "principles": [
    {
      "id": "reachable",
      "title": "Reachable"
    },
    {
      "id": "responsive",
      "title": "Responsive"
    },
    {
      "id": "complete",
      "title": "Complete"
    },
    {
      "id": "intelligible",
      "title": "Intelligible"
    },
    {
      "id": "accountable",
      "title": "Accountable"
    }
  ],
  "domains": [
    {
      "id": "A",
      "title": "Finding and Making a Request",
      "principle": "reachable",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a"
    },
    {
      "id": "B",
      "title": "Acknowledgement and Timeline",
      "principle": "responsive",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b"
    },
    {
      "id": "C",
      "title": "Identity Verification",
      "principle": "responsive",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c"
    },
    {
      "id": "D",
      "title": "Completeness and Scope",
      "principle": "complete",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d"
    },
    {
      "id": "E",
      "title": "Supplementary Information",
      "principle": "complete",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e"
    },
    {
      "id": "F",
      "title": "Intelligibility",
      "principle": "intelligible",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f"
    },
    {
      "id": "G",
      "title": "Format and Delivery",
      "principle": "intelligible",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g"
    },
    {
      "id": "H",
      "title": "Redaction and Exemptions",
      "principle": "accountable",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h"
    }
  ],
  "criteria": [
    {
      "id": "A1",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "A Findable Privacy Notice",
      "text": "Every page of the organisation's website links to its privacy notice.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a1"
    },
    {
      "id": "A2",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "A Signposted Route",
      "text": "The privacy notice explains how to make a subject access request, including where to send it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a2"
    },
    {
      "id": "A3",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "No Account Required",
      "text": "Making a request does not require creating an account where the person does not already hold one.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a3"
    },
    {
      "id": "A4",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "No Mandated Route",
      "text": "The organisation does not require a subject access request to be made through one particular route, such as a single form or online portal.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a4"
    },
    {
      "id": "A5",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "A Request in Any Wording",
      "text": "The organisation treats a request as valid whatever wording it uses.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a5"
    },
    {
      "id": "A6",
      "domain": "A",
      "level": 1,
      "assessment": "fact",
      "title": "A Verbal Request",
      "text": "The organisation treats a request made verbally as valid.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a6"
    },
    {
      "id": "A7",
      "domain": "A",
      "level": 2,
      "assessment": "fact",
      "title": "A Named Contact",
      "text": "The privacy notice names a data-protection contact and a direct way to reach them.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a7"
    },
    {
      "id": "A8",
      "domain": "A",
      "level": 2,
      "assessment": "fact",
      "title": "A Choice of Routes",
      "text": "At least two routes exist to make a request, one of which is an email address for subject access requests or the data-protection contact.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a8"
    },
    {
      "id": "A9",
      "domain": "A",
      "level": 2,
      "assessment": "judgement",
      "title": "A Proportionate Request Form",
      "text": "Where the organisation provides a request form, it asks for nothing beyond what is needed to identify the person and locate their data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a9"
    },
    {
      "id": "A10",
      "domain": "A",
      "level": 2,
      "assessment": "fact",
      "title": "A Request Made on Someone's Behalf",
      "text": "The organisation accepts a request made by someone the person has authorised to act for them.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a10"
    },
    {
      "id": "A11",
      "domain": "A",
      "level": 3,
      "assessment": "fact",
      "title": "The Right Explained",
      "text": "The privacy notice explains what the right of access lets a person do, not only that the right exists.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a11"
    },
    {
      "id": "A12",
      "domain": "A",
      "level": 3,
      "assessment": "judgement",
      "title": "No Discouragement",
      "text": "No step in making a request presents a message or question that urges the person to reconsider, narrow, or withdraw it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#a12"
    },
    {
      "id": "B1",
      "domain": "B",
      "level": 1,
      "assessment": "fact",
      "title": "A Response Within the Time Limit",
      "text": "The response is provided within one month of the request, or within an extended time limit the organisation has notified.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b1"
    },
    {
      "id": "B2",
      "domain": "B",
      "level": 1,
      "assessment": "fact",
      "title": "An Extension Notified in Time",
      "text": "Where the organisation extends the time limit, it tells the person within one month of the request.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b2"
    },
    {
      "id": "B3",
      "domain": "B",
      "level": 1,
      "assessment": "fact",
      "title": "An Extension Explained",
      "text": "Where the organisation extends the time limit, it states why the extension is needed.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b3"
    },
    {
      "id": "B4",
      "domain": "B",
      "level": 2,
      "assessment": "fact",
      "title": "Acknowledgement of Receipt",
      "text": "The organisation confirms to the person that it has received the request.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b4"
    },
    {
      "id": "B5",
      "domain": "B",
      "level": 2,
      "assessment": "fact",
      "title": "A Stated Response Date",
      "text": "The acknowledgement states the date by which the organisation will respond.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#b5"
    },
    {
      "id": "C1",
      "domain": "C",
      "level": 1,
      "assessment": "fact",
      "title": "No Verification on an Identified Route",
      "text": "The organisation does not request identity verification where the request comes through a route that already identifies the person.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c1"
    },
    {
      "id": "C2",
      "domain": "C",
      "level": 1,
      "assessment": "judgement",
      "title": "Proportionate Verification",
      "text": "Where the organisation requests identity verification, it asks only for what is necessary to confirm the person's identity.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c2"
    },
    {
      "id": "C3",
      "domain": "C",
      "level": 2,
      "assessment": "fact",
      "title": "Verification Explained",
      "text": "Where the organisation requests identity verification, it states why the verification is needed.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c3"
    },
    {
      "id": "C4",
      "domain": "C",
      "level": 2,
      "assessment": "fact",
      "title": "The Effect on the Time Limit Stated",
      "text": "Where the organisation requests identity verification, it states how this affects the time limit for responding.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c4"
    },
    {
      "id": "C5",
      "domain": "C",
      "level": 3,
      "assessment": "fact",
      "title": "Verification Data Not Retained",
      "text": "The organisation states that identity information provided for verification is used only to confirm identity and is not kept afterward.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#c5"
    },
    {
      "id": "D1",
      "domain": "D",
      "level": 1,
      "assessment": "fact",
      "title": "Confirmation of Processing",
      "text": "The response states whether or not the organisation processes the person's personal data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d1"
    },
    {
      "id": "D2",
      "domain": "D",
      "level": 1,
      "assessment": "fact",
      "title": "A Copy of the Data",
      "text": "Where the organisation processes the person's personal data, the response includes a copy of it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d2"
    },
    {
      "id": "D3",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "The Systems Searched",
      "text": "The response states which systems or records the organisation searched for the person's personal data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d3"
    },
    {
      "id": "D4",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "The Period Searched",
      "text": "The response states the date range the search covered.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d4"
    },
    {
      "id": "D5",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "Whether the Search Was Limited",
      "text": "The response states whether or not the organisation limited the scope of its search.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d5"
    },
    {
      "id": "D6",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "A Limit on the Search Explained",
      "text": "Where the response states that the organisation limited the scope of its search, it states what was not searched, and why.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d6"
    },
    {
      "id": "D7",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "A Request Not Narrowed Without Agreement",
      "text": "Where the organisation asks the person to specify what they want, it does not treat the request as withdrawn or narrowed if the person does not reply.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d7"
    },
    {
      "id": "D8",
      "domain": "D",
      "level": 2,
      "assessment": "fact",
      "title": "Data Held on the Organisation's Behalf",
      "text": "The response states whether the search covered personal data held on the organisation's behalf by another organisation.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d8"
    },
    {
      "id": "D9",
      "domain": "D",
      "level": 3,
      "assessment": "fact",
      "title": "Unstructured Records Included",
      "text": "The response states whether the search covered unstructured records, such as emails and documents, and not only structured databases.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#d9"
    },
    {
      "id": "E1",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Purposes",
      "text": "The response states the purposes for which the organisation processes the person's personal data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e1"
    },
    {
      "id": "E2",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Categories of Data",
      "text": "The response states the categories of the person's personal data that the organisation processes.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e2"
    },
    {
      "id": "E3",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Recipients",
      "text": "The response states the recipients, or categories of recipient, to whom the organisation has disclosed or will disclose the person's personal data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e3"
    },
    {
      "id": "E4",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Retention Period",
      "text": "The response states how long the organisation will keep the person's personal data, or the criteria it uses to decide.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e4"
    },
    {
      "id": "E5",
      "domain": "E",
      "level": 1,
      "assessment": "fact",
      "title": "The Person's Other Rights",
      "text": "The response states the person's rights to rectification, erasure, restriction, and objection.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e5"
    },
    {
      "id": "E6",
      "domain": "E",
      "level": 1,
      "assessment": "fact",
      "title": "The Right to Complain",
      "text": "The response states that the person can complain to the Information Commissioner's Office.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e6"
    },
    {
      "id": "E7",
      "domain": "E",
      "level": 1,
      "assessment": "fact",
      "title": "The Source of the Data",
      "text": "Where the organisation did not collect the personal data from the person, the response states any available information about its source.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e7"
    },
    {
      "id": "E8",
      "domain": "E",
      "level": 1,
      "assessment": "fact",
      "title": "Automated Decision-Making",
      "text": "The response states whether the organisation makes solely automated decisions about the person, including profiling.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e8"
    },
    {
      "id": "E9",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Logic Explained",
      "text": "Where the organisation makes solely automated decisions about the person, the response gives meaningful information about the logic involved.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e9"
    },
    {
      "id": "E10",
      "domain": "E",
      "level": 1,
      "assessment": "judgement",
      "title": "The Consequences Explained",
      "text": "Where the organisation makes solely automated decisions about the person, the response states the significance of those decisions and their likely consequences.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e10"
    },
    {
      "id": "E11",
      "domain": "E",
      "level": 1,
      "assessment": "fact",
      "title": "Safeguards for Transfers Abroad",
      "text": "Where the organisation transfers the person's personal data outside the UK, the response states the safeguards it relies on for the transfer.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e11"
    },
    {
      "id": "E12",
      "domain": "E",
      "level": 2,
      "assessment": "fact",
      "title": "Recipients Named",
      "text": "The response names the actual recipients of the person's personal data, not only categories of recipient, unless naming a recipient is not possible.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e12"
    },
    {
      "id": "E13",
      "domain": "E",
      "level": 2,
      "assessment": "judgement",
      "title": "Written for the Person",
      "text": "The supplementary information describes how the organisation processes the person's own data, not only what its general privacy notice says.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e13"
    },
    {
      "id": "E14",
      "domain": "E",
      "level": 3,
      "assessment": "fact",
      "title": "A Specific Retention Period",
      "text": "The response gives a retention period for the person's personal data, rather than only the criteria for deciding one.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#e14"
    },
    {
      "id": "F1",
      "domain": "F",
      "level": 1,
      "assessment": "fact",
      "title": "Codes and Terms Explained",
      "text": "Where the response or the copy uses codes, abbreviations, or technical terms, the response explains what they mean.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f1"
    },
    {
      "id": "F2",
      "domain": "F",
      "level": 1,
      "assessment": "fact",
      "title": "What Each Part Is",
      "text": "The response identifies what each part of the copy is.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f2"
    },
    {
      "id": "F3",
      "domain": "F",
      "level": 2,
      "assessment": "judgement",
      "title": "Organised to Navigate",
      "text": "The response is organised so the person can find their way through it, rather than presented as an undifferentiated bundle.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f3"
    },
    {
      "id": "F4",
      "domain": "F",
      "level": 2,
      "assessment": "judgement",
      "title": "Clear to a Child",
      "text": "Where the response is addressed to a child, it uses language the child can understand.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f4"
    },
    {
      "id": "F5",
      "domain": "F",
      "level": 3,
      "assessment": "fact",
      "title": "A Guide to the Response",
      "text": "The response includes a short guide to what it contains and how it is arranged.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f5"
    },
    {
      "id": "F6",
      "domain": "F",
      "level": 3,
      "assessment": "judgement",
      "title": "Plain Language",
      "text": "A person without specialist knowledge of the organisation's systems or of data-protection law can understand the response.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#f6"
    },
    {
      "id": "G1",
      "domain": "G",
      "level": 1,
      "assessment": "fact",
      "title": "Provided Free",
      "text": "The organisation provides the response free of charge.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g1"
    },
    {
      "id": "G2",
      "domain": "G",
      "level": 1,
      "assessment": "fact",
      "title": "Electronic by Default",
      "text": "Where the person made the request by electronic means, the response is provided in a commonly used electronic form, unless the person asked for another form.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g2"
    },
    {
      "id": "G3",
      "domain": "G",
      "level": 1,
      "assessment": "fact",
      "title": "Delivered Securely",
      "text": "The organisation delivers the response by a means that protects it from being read by anyone other than the person.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g3"
    },
    {
      "id": "G4",
      "domain": "G",
      "level": 2,
      "assessment": "fact",
      "title": "A Usable Format",
      "text": "The response is provided in a format the person can open and reuse with commonly available software, not as images of the personal data or a file locked against reuse.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g4"
    },
    {
      "id": "G5",
      "domain": "G",
      "level": 2,
      "assessment": "fact",
      "title": "No Barrier to Collection",
      "text": "Receiving the response does not require creating an account where the person does not already hold one, or using one particular portal.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g5"
    },
    {
      "id": "G6",
      "domain": "G",
      "level": 2,
      "assessment": "fact",
      "title": "An Accessible Format on Request",
      "text": "Where the person needs the response in an accessible format, the organisation provides it in that format.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g6"
    },
    {
      "id": "G7",
      "domain": "G",
      "level": 3,
      "assessment": "fact",
      "title": "Accessible by Default",
      "text": "The response meets recognised accessibility standards, so a person using assistive technology can read it without having to ask for an alternative.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#g7"
    },
    {
      "id": "H1",
      "domain": "H",
      "level": 1,
      "assessment": "fact",
      "title": "Refusal Explained",
      "text": "Where the organisation refuses a request in whole or in part, the response states the reasons.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h1"
    },
    {
      "id": "H2",
      "domain": "H",
      "level": 1,
      "assessment": "fact",
      "title": "How to Challenge a Refusal",
      "text": "Where the organisation refuses a request in whole or in part, the response tells the person they can seek a remedy from the Information Commissioner's Office or a court.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h2"
    },
    {
      "id": "H3",
      "domain": "H",
      "level": 1,
      "assessment": "fact",
      "title": "Redaction Shown",
      "text": "Where the organisation redacts information from the copy, the response shows that something has been redacted.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h3"
    },
    {
      "id": "H4",
      "domain": "H",
      "level": 2,
      "assessment": "fact",
      "title": "The Ground Stated",
      "text": "For each redaction, the response states the ground relied on.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h4"
    },
    {
      "id": "H5",
      "domain": "H",
      "level": 2,
      "assessment": "judgement",
      "title": "Redaction Limited to What Is Withheld",
      "text": "Each redaction covers only the information withheld, and not the surrounding text, page, or record that contains it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h5"
    },
    {
      "id": "H6",
      "domain": "H",
      "level": 2,
      "assessment": "fact",
      "title": "A Record Withheld in Full Explained",
      "text": "Where the organisation withholds a record in full under an exemption, the response states why no part of it could be disclosed.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h6"
    },
    {
      "id": "H7",
      "domain": "H",
      "level": 2,
      "assessment": "fact",
      "title": "A Charge or Rejection Justified",
      "text": "Where the organisation charges a fee, or rejects the request as manifestly unfounded or excessive, the response states why.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h7"
    },
    {
      "id": "H8",
      "domain": "H",
      "level": 2,
      "assessment": "fact",
      "title": "How to Complain to the Organisation",
      "text": "The response states how the person can complain to the organisation about it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h8"
    },
    {
      "id": "H9",
      "domain": "H",
      "level": 3,
      "assessment": "judgement",
      "title": "The Reason Explained",
      "text": "Where the organisation relies on an exemption, the response explains why it applies to the redacted data, not only which exemption it is.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#h9"
    }
  ],
  "glossary": [
    {
      "id": "acknowledgement",
      "term": "acknowledgement",
      "definition": "The organisation's confirmation to the person that it has received the request.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#acknowledgement"
    },
    {
      "id": "copy",
      "term": "copy",
      "definition": "The reproduction of the person's personal data that the organisation provides in the response, as distinct from the supplementary information about it.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#copy"
    },
    {
      "id": "data-protection-contact",
      "term": "data-protection contact",
      "definition": "The person or team the organisation identifies as responsible for data-protection matters, including requests. Where the organisation has appointed a Data Protection Officer, the data-protection contact is that officer.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#data-protection-contact"
    },
    {
      "id": "exemption",
      "term": "exemption",
      "definition": "A legal ground on which the organisation may withhold some personal data from the response.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#exemption"
    },
    {
      "id": "extension",
      "term": "extension",
      "definition": "An addition to the time limit that the law allows where a request is complex, or where the organisation has received a number of requests from the same person. An extension can be up to two further months.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#extension"
    },
    {
      "id": "identity-verification",
      "term": "identity verification",
      "definition": "Steps the organisation takes to confirm that the person making the request is who they say they are. The information the organisation asks for to do this is the person's identity information.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#identity-verification"
    },
    {
      "id": "the-organisation",
      "term": "the organisation",
      "definition": "The body that determines the purposes and means of processing the personal data, and to which the request is made.",
      "aka": "controller",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#the-organisation"
    },
    {
      "id": "the-person",
      "term": "the person",
      "definition": "The identified or identifiable individual the personal data is about, who is exercising the right of access.",
      "aka": "data subject",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#the-person"
    },
    {
      "id": "personal-data",
      "term": "personal data",
      "definition": "Information relating to the person, from which they can be identified directly or indirectly.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#personal-data"
    },
    {
      "id": "privacy-notice",
      "term": "privacy notice",
      "definition": "The public document in which the organisation explains how and why it processes personal data, and how a person can exercise their rights.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#privacy-notice"
    },
    {
      "id": "recipient",
      "term": "recipient",
      "definition": "A person or organisation to whom the organisation discloses the person's personal data.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#recipient"
    },
    {
      "id": "record",
      "term": "record",
      "definition": "A single item the organisation holds in which the person's personal data appears, such as a file, an email, or an entry in a database.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#record"
    },
    {
      "id": "redaction",
      "term": "redaction",
      "definition": "The removal or obscuring of information from the copy, such as another person's data or material an exemption covers.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#redaction"
    },
    {
      "id": "request-form",
      "term": "request form",
      "definition": "A form the organisation provides for making a request.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#request-form"
    },
    {
      "id": "the-response",
      "term": "the response",
      "definition": "What the organisation provides in answer to the request: confirmation of whether it processes the person's data, a copy of that data, and the supplementary information about the processing.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#the-response"
    },
    {
      "id": "the-right-of-access",
      "term": "the right of access",
      "definition": "The person's right to obtain from the organisation confirmation that their personal data is being processed, a copy of that data, and the supplementary information about the processing. It is set out in Article 15 of the UK GDPR.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#the-right-of-access"
    },
    {
      "id": "route",
      "term": "route",
      "definition": "A means by which the person can make a request, such as an email address, a form, a postal address, or a feature within an account.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#route"
    },
    {
      "id": "search",
      "term": "search",
      "definition": "The steps the organisation takes to find the person's personal data across its systems and records, structured and unstructured alike.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#search"
    },
    {
      "id": "subject-access-request",
      "term": "subject access request",
      "definition": "A request by the person to the organisation to exercise the right of access. Shortened to the request throughout this standard.",
      "aka": "SAR, DSAR",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#subject-access-request"
    },
    {
      "id": "supplementary-information",
      "term": "supplementary information",
      "definition": "The information about the processing that the response includes alongside the copy of personal data: the purposes, the categories of data, the recipients, the retention period, the person's rights, the source of the data, and any automated decision-making.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#supplementary-information"
    },
    {
      "id": "time-limit",
      "term": "time limit",
      "definition": "The period within which the organisation provides the response: one month from the day the request is received, unless extended as the law allows.",
      "url": "https://www.digitalconsumers.org.uk/osas/1.0#time-limit"
    }
  ]
}