Data Held on the Organisation's Behalf

Intent

Data held by a supplier on the organisation's behalf is still the organisation's to disclose. It is also where a search most often stops without anyone saying so.

How to test it

An assessor scores the criterion against a single response:

Score 2

The response states whether the search covered personal data held on the organisation's behalf by another organisation.

Score 1

The response mentions a supplier or a third-party system without saying whether its data was searched.

Score 0

The response says nothing about data held on the organisation's behalf.

The law it reflects

This criterion reflects Article 15(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See D8 in context in the full standard.