Unstructured Records Included
The response states whether the search covered unstructured records, such as emails and documents, and not only structured databases.
Intent
Most of what an organisation holds about a person sits in email and documents, not in a database. A search of databases alone misses it, and the response does not show that.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response states whether the search covered unstructured records such as emails and documents.
- Score 0
- The response says nothing about whether the search covered unstructured records.
The law it reflects
This criterion reflects Article 15(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D9 in context in the full standard.