A Choice of Routes
At least 2 routes exist for making a request, one of which is an email address for subject access requests or for the data-protection contact.
Intent
One route can fail - a form breaks, or a portal locks the person out. A second route gets the request through, and an email leaves the person a copy of what they sent.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- Two or more routes are offered, one of them an email address for subject access requests or the data-protection contact.
- Score 1
- Two or more routes are offered, but none of them an email address.
- Score 0
- Only one route is offered.
The law it reflects
This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See A8 in context in the full standard.