A Signposted Route

The privacy notice explains how to make a subject access request, including where to send it.

Criterion: A2
Level: Level 1
Domain: Finding and Making a Request
Reflects: Article 12(1)

Intent

Knowing the right exists is not the same as knowing how to use it. Because the privacy notice is where people look, it has to say how to make a request and where to send it.

How to test it

An assessor scores the criterion against a single response:

Score 2: The privacy notice says how to make a subject access request and gives an address to send it to.
Score 1: The notice mentions the right but does not say how to make a request, or where to send it.
Score 0: The notice does not say how to make a request.

The law it reflects

This criterion reflects Article 12(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A2 in context in the full standard.