No Mandated Route

The organisation does not require a subject access request to be made through one particular route, such as a single form or online portal.

Criterion: A4
Level: Level 1
Domain: Finding and Making a Request
Reflects: Article 12(2)

Intent

An organisation that takes requests one way only can refuse a request on a technicality. It also shuts out the people who cannot use that route.

How to test it

An assessor scores the criterion against a single response:

Score 2: The organisation acts on a request however it arrives, and names no route the person has to use.
Score 1: The organisation says a request has to use one particular route, but acts on one made another way.
Score 0: The organisation refuses, or does not act on, a request that did not use the route it requires.

The law it reflects

This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A4 in context in the full standard.