The Recipients
The response states the recipients, or categories of recipient, to whom the organisation has disclosed or will disclose the person's personal data.
Intent
Who else has the data is often the thing a person most wants to know, and the thing they cannot discover any other way.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response names the recipients, gives categories specific enough to tell who has the data, or states that it has been disclosed to nobody.
- Score 1
- The response says data may be shared with partners or suppliers without saying which kinds.
- Score 0
- The response says nothing about recipients.
The law it reflects
This criterion reflects Article 15(1)(c) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E3 in context in the full standard.