A Proportionate Request Form

Where the organisation provides a request form, it asks for nothing beyond what is needed to identify the person and locate their data.

Criterion: A9
Level: Level 2
Domain: Finding and Making a Request
Reflects: Article 5(1)(c)

Intent

A form is where an organisation can quietly collect more than the request needs. Anything beyond identifying the person and finding their data is data the organisation gained from someone exercising a right.

How to test it

An assessor scores the criterion against a single response:

Score 2: Every field on the request form serves either to identify the person or to locate their data.
Score 1: The form asks for something beyond that, such as a reason for the request or a marketing preference, but the person can leave it blank.
Score 0: The form requires something beyond identifying the person and locating their data before it can be submitted.
Not applicable: The organisation provides no request form.

The law it reflects

This criterion reflects Article 5(1)(c) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See A9 in context in the full standard.