Subject Access Response Assessment (SARA)

Assess a response

The assessment tool works through the criteria one at a time and reports a score for each domain and one score overall.

What SARA assesses

SARA scores an organisation’s handling of a subject access request against every OSAS criterion. An assessor needs 3 things: the organisation’s website as it stood when the request was made, the correspondence between the person and the organisation, and the response.

The scale

An assessor gives each criterion one of 4 scores:

Score 2: The response meets the criterion.
Score 1: The response partly meets the criterion.
Score 0: The response does not meet the criterion.
Not applicable: The condition of the criterion does not arise.

Fact and judgement

Some scores are a matter of fact, and others a matter of judgement.

52 criteria are a matter of fact. A response either states the date range searched, or it does not.
15 criteria are a matter of judgement, because 2 competent assessors could reasonably disagree. Whether a response uses plain language is one such criterion. The standard marks these criteria.

Criteria that do not apply

Some criteria apply only in certain circumstances. An organisation that makes no solely automated decisions is not scored on the 3 criteria about automated decisions, and those criteria score “not applicable”.

Criteria that do not apply leave the total. For conformance, a criterion that does not apply counts as met.

Reporting a result

A reported result gives a score for each domain and one score overall. Where 12 criteria in a domain apply, the score for that domain is a number out of 24, because each criterion can score up to 2. A result also names the highest level fully met, which is a conformance claim rather than a score.

A result states:

The version assessed: OSAS 1.0.
What it covered.
The date of the assessment.
Who carried it out.

A worked example

A1 concerns whether a link to the privacy notice appears on every page of the organisation’s website.

An assessor opens the site. The footer carries a link to the privacy notice, and the footer appears on every page except the checkout steps. A1 scores 1, because the notice is linked from most pages but is missing from some. A link on every page would score 2. A notice that the person can reach only from a page they already have to know about would score 0.

For the criteria themselves, see the full standard.