Data Held on the Organisation's Behalf
The response states whether the search covered personal data held on the organisation's behalf by another organisation.
Intent
Data a supplier holds for the organisation is still the organisation’s to disclose. It is also where a search often stops without anyone saying so.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response states whether the search covered personal data held on the organisation’s behalf by another organisation.
- Score 1
- The response mentions a supplier or a third-party system without saying whether its data was searched.
- Score 0
- The response says nothing about data held on the organisation’s behalf.
The law it reflects
This criterion reflects Article 15(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D8 in context in the full standard.