The Systems Searched
The response states which systems or records the organisation searched for the person's personal data.
Intent
Nobody outside the organisation can tell whether a search was complete. Naming the systems searched gives the person and an assessor something they can check.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response names the systems or records the organisation searched.
- Score 1
- The response says a search was carried out without naming what it covered.
- Score 0
- The response says nothing about what was searched.
The law it reflects
This criterion reflects Article 5(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D3 in context in the full standard.