Written for the Person
The supplementary information describes how the organisation processes the person's own data, not only what its general privacy notice says.
Intent
Pasting the general privacy notice answers a question nobody asked. The person wants to know how their own data was handled, not how data is handled in principle.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The supplementary information describes how the organisation processes this person's data.
- Score 1
- The response combines general privacy notice text with some detail specific to the person.
- Score 0
- The response reproduces the general privacy notice and adds nothing about this person, or gives no supplementary information at all.
The law it reflects
This criterion reflects Article 12(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E13 in context in the full standard.