A Signposted Route

The privacy notice explains how to make a subject access request, including where to send it.

Criterion: A2
Level: Level 1
Domain: Finding and Making a Request
Reflects: Article 12(1)

Intent

Knowing the right exists does not tell a person how to use it. People look in the privacy notice, so that is where the steps for making a request belong.

How to test it

An assessor scores the criterion against a single response:

Score 2: The privacy notice says how to make a subject access request, and gives an address to send it to.
Score 1: The notice says how to make a request but not where to send it, or gives an address but does not say how.
Score 0: The notice says neither how to make a request nor where to send it.

The law it reflects

This criterion reflects Article 12(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A2 in context in the full standard.