Confirmation of Processing
The response states whether or not the organisation processes the person's personal data.
Intent
The first thing the right delivers is an answer to whether the organisation processes the person's data at all. A person told nothing cannot tell a nil return from a request that was dropped.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response states that the organisation processes the person's personal data, or that it processes none.
- Score 0
- The response does not state whether or not the organisation processes the person's personal data.
The law it reflects
This criterion reflects Article 15(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See D1 in context in the full standard.