The Open Subject Access Standard (OSAS)

What OSAS is

A subject access request is when a person asks an organisation for a copy of the data it holds about them. The law says the organisation must answer. It says little about how well, or about how easy it should be to make one in the first place. OSAS fills that gap with a set of testable criteria, grouped into domains. They cover the whole journey: finding out how to make a request, making it, the search the organisation runs, what it withholds, and how it delivers the result.

• OSAS scores the whole handling of a request, from finding the organisation’s privacy notice and how to make a request, to the data it provides.
• It sets three cumulative conformance levels: Level 1, Level 2, and Level 3.
• It scores what an organisation shows, not what it claims. Where nobody outside can check whether the answer is right, OSAS scores whether the organisation shows its working.
• Anyone can apply it. The criteria, the assessment method, and a fully worked example are published in full.
• It is free to read, free to use, and openly governed.

Conformance levels

OSAS sets three levels. Each includes the level below it, so a response meets every criterion at a level to reach it.

• Level 1. The person receives a response, on time, that covers what the law requires and can be read.
• Level 2. The person can check the response and act on it. They know what was searched, what was withheld and on what ground, and what to do next.
• Level 3. The response is built for the person who asked, not for the organisation that answers.

No level means ‘legally compliant’. The levels describe what a response does for the person. A separate table maps each criterion to the part of the law it reflects.

Read the conformance model.

How the standard is organised

OSAS has three layers, so the parts that stay fixed are kept apart from the parts that change often.

• Domains and criteria. Eight domains, each holding a short set of numbered, testable criteria. The numbers stay fixed: criterion D3 means D3 in every edition.
• Levels. Each criterion sits at one of the three levels.
• Techniques. A separate, living document shows how to meet each criterion. It is updated as practice moves, without changing the criteria.

The eight domains are: finding and making a request; acknowledgement and timeline; identity verification; scope and search; Article 15 information; intelligibility; redaction and exemptions; and format and delivery.

See all criteria.

Assessing a response

SARA, the Subject Access Response Assessment, is how a response is scored against OSAS. It is one instrument with two uses:

• An organisation runs it on itself to make a conformance claim.
• Anyone else runs it on a response they received, to score it.

SARA scores each criterion 2, 1, 0, or not applicable. It reports a figure for each domain and one overall, alongside the highest level fully met. Its output works as a ready-made annex when the person complains to the Information Commissioner’s Office.

How SARA works.

Reference material

OSAS comes with the material you need to apply it, not the criteria alone.

• A reference response pack. A single worked example at the top level.
• The techniques document. How to meet each criterion.
• A machine-readable schema. For the manifest that accompanies a response, and for assessment records, so any score can be reproduced.
• A calibration set. Ten scored responses that an assessor matches before their scores count, so two people score the same response the same way.

Browse the reference material.

Versions

This is OSAS 1.0. Every version keeps a permanent page and a dated record of each change. A point release adds a criterion or clarifies wording. Only a major release moves a criterion between levels or removes one, because either changes what an existing claim means.

Who maintains OSAS

The Centre for Digital Consumers publishes and maintains OSAS. The criteria are public, and the record of changes is public. If you think a criterion is wrong, or a score is wrong, tell us. See our contact page.