Whether the Search Was Limited
The response states whether or not the organisation limited the scope of its search.
Intent
Nobody outside the organisation can tell a full search from one that stopped short. Saying either way makes the question answerable.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response says either that the search covered everywhere the organisation processes the person’s personal data, or that it was limited.
- Score 0
- The response says nothing about whether the search was limited.
The law it reflects
This criterion reflects Article 5(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D5 in context in the full standard.