The Source of the Data

Where the organisation did not collect the personal data from the person, the response states any available information about its source.

Criterion: E7
Level: Level 1
Domain: Supplementary Information
Reflects: Article 15(1)(g)

Intent

Data an organisation bought or was given is data the person never handed over. The source is how they find out it exists and where to go next.

How to test it

An assessor scores the criterion against a single response:

Score 2: The response states what the organisation knows about where the data came from.
Score 1: The response says the data came from other organisations without naming any of them.
Score 0: The response says nothing about the source of data the person did not provide.
Not applicable: The organisation collected all of the personal data from the person.

The law it reflects

This criterion reflects Article 15(1)(g) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See E7 in context in the full standard.