The Person's Other Rights
The response states the person's rights to rectification, erasure, restriction, and objection.
Intent
Access is one right among several. A person who has just seen their data is at the point of wanting it corrected or deleted, and needs to know they can ask.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response names all four rights.
- Score 1
- The response names some of the four rights but not all of them.
- Score 0
- The response names none of the four rights.
The law it reflects
This criterion reflects Article 15(1)(e) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E5 in context in the full standard.