Contact information

Please fill below your information to start the assessment.

1. GOVERNANCE AND ACCOUNTABILITY

Data protection and information governance responsibilities throughout an organisation including accountability.

1.1

Decision makers and key people in your business demonstrate support for data protection legislation and promote a positive culture of data protection compliance across the business

1.2

Where required, your business has appointed a DPO. In other cases, you have nominated a data protection lead.

1.3

Your business is not located in Europe and your business processes the personal data of people who are in Europe, so your business has appointed an EU representative.

2. RECORD OF PROCESSING ACTIVITIES

Procedures and records to support accurate and effective documentation of data processing, in line with GDPR requirements.

2.1

Your business has conducted an information audit to map data flows.

2.2

Your business has documented what personal data you hold, where it came from, who you share it with and what you do with it.

3. LAWFULNESS

Procedures about the lawful basis for processing personal data and special category personal data, and about consent (especially regarding children).

3.1

Your business has identified your lawful bases for processing and documented them.

3.2

Your business has reviewed how you ask for and record consent.

3.3

Your business has systems to record and manage ongoing consent.

3.4

If your business relies on consent to offer online services directly to children, you have systems in place to manage it.

3.5

If you may be required to process data to protect the vital interests of an individual, your business has clearly documented the circumstances where it will be relevant. Your business documents your justification for relying on this basis and informs individuals where necessary.

3.6

If you are relying on legitimate interests as the lawful basis for processing, your business has applied the three part test and can demonstrate you have fully considered and protected individual’s rights and interests.

4. POLICIES, PROCEDURES AND TRAINING

Appropriate data protection policies, procedures and training across data protection and information governance.

4.1

Your business has processes in place to ensure that the personal data you hold remains accurate and up to date.

4.2

Your business has a process to securely dispose of personal data that is no longer required or where an individual has asked for it to be erased.

4.3

Your business has procedures to respond to an individual’s request to restrict the processing of their personal data.

4.4

Your business has processes to allow individuals to move, copy or transfer their personal data from one IT environment to another in a safe and secure way, without hindrance to usability.

4.5

Your business has procedures to handle an individual’s objection to the processing of their personal data.

4.6

Your business has identified whether any of your processing operations constitute automated decision making under Article 22 of the GDPR and has procedures in place to deal with the requirements.

4.7

Your business has an appropriate data protection policy.

4.8

Your business provides data protection awareness training for all staff.

5. DATA PROTECTION IMPACT ASSESSMENT (DPIA)

Policies and procedures regarding data protection impact assessments, which are embedded in wider policies and procedures.

5.1

Your business manages information risks in a structured way so that management understands the business impact of personal data related risks and manages them effectively.

5.2

Your business understands when you must conduct a DPIA and has processes in place to action this.

5.3

Your business has a DPIA framework which links to your existing risk management and project management processes.

6. INFORMATION AND TRANSPARENCY

Procedures are in place to ensure that transparent information is provided in a timely way, using succinct, clear and plain language, and is updated where relevant.

6.1

Your business has made privacy information readily available to individuals.

6.2

Your business communicates privacy information in a way that a child will understand.

7. DATA SUBJECTS ACCESS RIGHTS

Policies and procedures to handle requests for information and other individual rights.

7.1

Your business has established a process to recognise and respond to individuals' requests to access their personal data.

8. DATA BREACHES

Polices and procedures regarding the detection, investigation, recording and reporting of breaches, where necessary.

8.1

Your business has effective processes to identify, report, manage and resolve any personal data breaches.

9. CONTRACTS AND INTERNATIONAL TRANSFERS

Contracts including those: with third parties processing personal data; evidencing data transfer mechanisms; and involving data sharing. Policies and procedures regarding contracts involving personal data.

9.1

Your business has a written contract with any processors you use.

9.2

Your business ensures an adequate level of protection for any personal data processed by others on your behalf that is transferred outside the European Economic Area.

10. PRIVACY BY DESIGN AND BY DEFAULT

Policies, procedures and a privacy culture embedding data protection in all activities involving personal data from beginning to end (such as the design of services or products), and which uphold data minimisation.

10.1

Your business has implemented appropriate technical and organisational measures to integrate data protection into your processing activities.

11. SECURITY

Policies, procedures and security controls to ensure the security of personal data including evidence of how systems are maintained and updated as required.

11.1

Your business has an information security policy supported by appropriate security measures.

12. MONITORING

Internal and external auditing of data protection compliance and information governance, regular internal monitoring of procedures and practices, and making revisions where required.

12.1

Your business monitors its own compliance with data protection policies and regularly reviews the effectiveness of data handling and security controls.

CONTROLLER CHECKLIST REPORT

CONGRATULATIONS, you have successfully completed the assessment. Here is your GDPR compliance score:

Your score is based on your self-assessment and has no legal value. We are expert in GDPR and we can provide you with practical solutions to improve your level of compliance according to your needs and your legal obligations.

We can help you, click the button and get some free recommendations.