User awareness

What the clause says

The system should tell the person what is being checked, what is retained and what is disclosed, in language they can understand.

What it supplies to a comparison

A comparison can test comprehension, not only the presence of a notice. A notice a child cannot understand does not meet the objective.

Evidence to keep

• The notice text and the reading level it was written for.
• A comprehension test with representative users.

What the evidence looks like

For 7.1.6, the first artefact is The notice text and the reading level it was written for.. The second is A comprehension test with representative users.. If 7.1.6 has no first artefact, the practice is unproven at 7.1.6, and the report should record the absence rather than infer the practice from a policy.

Questions for the provider

1. Would a twelve-year-old understand what the notice says?
2. Does the notice match the observed data flow?

How it connects to the draft

User awareness belongs to 7 privacy objectives, and it gives the analysis one fixed point: A comparison can test comprehension, not only the presence of a notice. A notice a child cannot understand does not meet the objective. A comparison that cannot place a result against 7.1.6 is measuring something the framework has not defined, and the report should say so.

In the register, 7.1.6 is read beside the unit that tests it, and where it sets an objective rather than a number, that unit turns the objective into a question and an evidence artefact.