A Signposted Route
The privacy notice explains how to make a subject access request, including where to send it.
Intent
Knowing the right exists does not tell a person how to use it. People look in the privacy notice, so the steps for making a request belong there.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The notice says how to make a subject access request and gives an address to send it to.
- Score 1
- The notice says how to make a request but not where to send it, or gives an address but not how.
- Score 0
- The notice says neither how to make a request nor where to send it.
The law it reflects
This criterion reflects Article 12(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See A2 in context in the full standard.