Acceptability to the individual

What the clause says

A person should be able to form a view on whether a solution meets their privacy and security expectations. Each solution should publicly disclose how it meets the privacy and security objectives.

What it supplies to a comparison

Disclosure is a comparison criterion in its own right. A system that performs well but cannot explain its privacy and security position fails the acceptability test the framework sets.

Evidence to keep

• The public statement of how the privacy objectives are met.
• The public statement of how the security objectives are met.

What the evidence looks like

For 4.6, the first artefact is The public statement of how the privacy objectives are met.. The second is The public statement of how the security objectives are met.. If 4.6 has no first artefact, the practice is unproven at 4.6, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Can a member of the public find and understand the privacy and security disclosure?
2. Does the disclosure match what the test observed?

How it connects to the draft

Acceptability to the individual belongs to 4 characterisation, and it gives the analysis one fixed point: Disclosure is a comparison criterion in its own right. A system that performs well but cannot explain its privacy and security position fails the acce. A comparison that cannot place a result against 4.6 is measuring something the framework has not defined, and the report should say so.

In the register, 4.6 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.