The Purposes
The response states the purposes for which the organisation processes the person's personal data.
Intent
A list of data tells the person what the organisation has. The purposes tell them what it does with it, which is what they can object to.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response names each purpose closely enough for the person to tell what the organisation does with their data.
- Score 1
- The response gives purposes so broad they would cover almost any use.
- Score 0
- The response states no purpose at all.
The law it reflects
This criterion reflects Article 15(1)(a) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E1 in context in the full standard.