The Right Explained
The privacy notice explains what the right of access lets a person do, not only that the right exists.
Intent
A notice that says the right exists leaves the person to find out what it gets them. Saying what the right delivers is what turns it into something a person can use.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The privacy notice says what the person receives when they exercise the right of access, such as a copy of their data and information about how it is used.
- Score 1
- The notice names the right of access and links elsewhere for what it delivers.
- Score 0
- The notice states that the right of access exists and says no more about it, or does not mention the right at all.
The law it reflects
This criterion reflects Article 13(2)(b) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See A11 in context in the full standard.