No Barrier to Collection
Receiving the response does not require the person to create an account where they do not already hold one, or to use one particular portal.
Intent
An account the person must create to collect their data is a barrier at the last step.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The person could collect the response without creating an account or using one particular portal.
- Score 1
- The response was delivered through a portal, but the person could ask for another way and get it.
- Score 0
- Collecting the response required creating an account, or using one portal with no alternative.
The law it reflects
This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See G5 in context in the full standard.