A Copy of the Data

Where the organisation processes the person's personal data, the response includes a copy of it.

Criterion: D2
Level: Level 1
Domain: Completeness and Scope
Reflects: Article 15(3)

Intent

The copy is what the person asked for. Everything else in the response is context around it.

How to test it

An assessor scores the criterion against a single response:

Score 2: The response includes a copy of the person's personal data.
Score 1: The response describes the data, or summarises it, without providing a copy of the data itself.
Score 0: The response provides no copy of the person's personal data.
Not applicable: The organisation does not process the person's personal data.

The law it reflects

This criterion reflects Article 15(3) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See D2 in context in the full standard.