Subject Access Response Assessment (SARA)

Assess a response

The assessment tool takes each criterion in turn and reports a score for each domain and one overall.

What SARA assesses

SARA scores an organisation’s handling of a subject access request against every OSAS criterion. An assessor needs three things: the organisation’s website as it stood when the request was made, the correspondence, and the response.

The scale

An assessor gives each criterion one of four scores:

Score 2

The response meets the criterion.

Score 1

The response partly meets it.

Score 0

The response does not meet it.

Not applicable

The criterion’s condition does not arise.

Fact and judgement

Some scores are a matter of fact, and others a matter of judgement.

• 52 criteria are a matter of fact. The response either states the date range searched or it does not.
• 15 are a matter of judgement, because two competent assessors could reasonably disagree. Whether a response uses plain language is one. The standard marks these criteria.

Criteria that do not apply

Some criteria only apply in certain circumstances. An organisation that makes no solely automated decisions is not scored on the three criteria about them: those score “not applicable”.

These criteria leave the total. For conformance, a criterion that does not apply counts as met.

Reporting a result

A reported result gives a score for each domain and one score overall. Where 12 criteria in a domain apply, the score for that domain is a number out of 24. A result also names the highest level fully met, which is a conformance claim rather than a score.

A result states:

• The version assessed: OSAS 1.0.
• What it covered.
• The date of the assessment.
• Who carried it out.

A worked example

A1 requires a link to the privacy notice on every page of the organisation’s website.

An assessor opens the site. The footer carries a link to the privacy notice, and the footer appears on every page except the checkout steps. A1 scores 1: the notice is linked from most pages, but missing from some. A link on every page scores 2. A notice the person can reach only from a page they must already know to visit scores 0.

For the criteria themselves, see the full standard.