Recipients Named
The response names the actual recipients of the person's personal data, not only categories of recipient, unless naming a recipient is not possible.
Intent
Categories of recipient tell a person that their data went somewhere without telling them where. Names are what let them go and ask.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response names every recipient, or names those it can and says why the rest cannot be named.
- Score 1
- The response names some recipients and gives the rest only as categories, without saying why they cannot be named.
- Score 0
- The response gives categories of recipient only, or says nothing about recipients either way.
- Not applicable
- The response states that the organisation has disclosed the person's personal data to nobody.
The law it reflects
This criterion reflects Article 15(1)(c) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E12 in context in the full standard.