A Copy of the Data
Where the organisation processes the person's personal data, the response includes a copy of it.
Intent
The copy is what the person asked for. The rest of the response explains it.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response includes a copy of the person’s personal data.
- Score 1
- The response describes or summarises the data without providing a copy of the data itself.
- Score 0
- The response provides no copy of the person’s personal data.
- Not applicable
- The organisation does not process the person’s personal data.
The law it reflects
This criterion reflects Article 15(3) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D2 in context in the full standard.