No Mandated Route

The organisation does not require a subject access request to be made through one particular route, such as a single form or online portal.

Criterion: A4
Level: Level 1
Domain: Finding and Making a Request
Reflects: Article 12(2)

Intent

A request is valid however it reaches the organisation. Insisting on one channel lets a request be refused on a technicality, and shuts out people who cannot use that channel.

How to test it

An assessor scores the criterion against a single response:

Score 2: The organisation accepts requests through more than one route and does not refuse a request made another way.
Score 1: The organisation pushes one route but still accepts a request made another way.
Score 0: Requests are accepted only through one route; any other is refused.

The law it reflects

This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A4 in context in the full standard.