No Mandated Route
The organisation does not require a subject access request to be made through one particular route, such as a single form or online portal.
Intent
An organisation that takes requests one way only can refuse on a technicality, and shuts out people who cannot use that route.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The organisation acts on a request however it arrives, and names no route the person has to use.
- Score 1
- The organisation says a request has to use one particular route, but acts on one made another way.
- Score 0
- The organisation refuses, or does not act on, a request that did not use the required route.
The law it reflects
This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See A4 in context in the full standard.