A Proportionate Request Form
Where the organisation provides a request form, it asks for nothing beyond what is needed to identify the person and locate their data.
Intent
A form is where an organisation can collect more than the request needs. Anything beyond identifying the person and finding their data is data it gained from someone using a right.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- Every field serves either to identify the person or to locate their data.
- Score 1
- The form asks for something beyond that, such as a reason for the request or a marketing preference, but the person can leave it blank.
- Score 0
- The form requires something beyond identifying the person and locating their data before it can be submitted.
- Not applicable
- The organisation provides no request form.
The law it reflects
This criterion reflects Article 5(1)(c) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See A9 in context in the full standard.