A Choice of Routes

At least two routes exist to make a request, one of which is an email address for subject access requests or the data-protection contact.

Criterion: A8
Level: Level 2
Domain: Finding and Making a Request
Reflects: Article 12(2)

Intent

One route can fail: a form breaks, a portal locks the person out. A second route, and an email address in particular, leaves a record the person keeps.

How to test it

An assessor scores the criterion against a single response:

Score 2: Two or more routes are offered, and one of them is an email address for subject access requests or for the data-protection contact.
Score 1: Two or more routes are offered, but none of them is an email address.
Score 0: Only one route is offered.

The law it reflects

This criterion reflects Article 12(2) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A8 in context in the full standard.