Plain Language
A person without specialist knowledge of the organisation's systems or of data-protection law can understand the response.
Intent
Everything else in this domain serves this: that a person with no knowledge of the organisation's systems or of data-protection law can read what they were sent and understand it.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- A person without specialist knowledge can read the response and say what data the organisation processes, what it is used for, and what to do next.
- Score 1
- The response is readable in parts, but passages of legal or system language would stop a person without specialist knowledge.
- Score 0
- Understanding the response depends on knowing the organisation's systems or data-protection law.
The law it reflects
This criterion reflects Article 12(1) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See F6 in context in the full standard.