No Barrier to Collection

Receiving the response does not require creating an account where the person does not already hold one, or using one particular portal.

Criterion: G5
Level: Level 2
Domain: Format and Delivery
Reflects: Article 12(2)

Intent

An account the person must create to collect their data is a barrier at the last step.

How to test it

An assessor scores the criterion against a single response:

Score 2: The person could collect the response without creating an account or using one particular portal.
Score 1: The response was delivered through a portal, but the person could ask for another way and get it.
Score 0: Collecting the response required creating an account, or using one portal with no alternative.

The law it reflects

This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See G5 in context in the full standard.