Conducting a GDPR Compliance Audit

The next questions relate to how well-prepared your governance and programs and controls are relating to GDPR. This questionnaire might go into extra element on a few of these matters as you undergo it.

The next questions relate to your total understanding of GDPR obligations.

The next questions relate to the lawful foundation of processing private knowledge by your workforce.

1. Do you perceive the place your buyer knowledge is?
2. Have you learnt the place your buyer knowledge comes from?
3. The place does buyer knowledge go round your organization, and the way does it journey?
4. Have you learnt of all forms of private knowledge being processed by your workforce and the aim(s) of processing?
5. Have you ever thought of if this processing is critical for the related goal?
6. Have you learnt of the lawful foundation on which this knowledge is collected and processed?
7. Have you learnt whether or not the aim(s) of processing and the lawful foundation is documented in your privateness discover?
8. In case the lawful foundation for processing is Consent, are you positive {that a} report is being saved of when and the way we obtained consent from the person, and what they have been informed about how and why we’d course of their knowledge on the time?
9. Is buyer consent obtained through a transparent and standalone assertion or doc, somewhat than being a part of a wider and unrelated set of phrases and situations or declarations?
10. Have you ever obtained a course of for notifying a buyer that we have to change or add to the explanations that we at the moment course of their knowledge, explaining why and acquiring their consent for this alteration?
11. Have you learnt when and whom to ask for an information safety influence evaluation (DPIA)?
12. How do you handle knowledge classification and communications? How is particular class knowledge handled in comparison with private knowledge? Are there any further controls or entry restrictions that you simply apply?
13. Have you ever issued truthful processing notices to your prospects?
14. Do you determine youngster account enterprise individually from all different accounts?
15. How are you demonstrating that the place acceptable (aged 13 within the UK) that you’ve youngster consent for processing their knowledge and that this consent is suitably knowledgeable?

The next questions relate to the safety (confidentiality, integrity and availability) of the non-public knowledge is processed by your workforce

The next questions relate to knowledge minimisation and storage of the non-public knowledge that’s processed by your workforce

1. Is the gathering of your buyer’s private knowledge restricted to what’s mandatory for the aim of processing knowledge?
2. Is there a evaluate or sign-off of your utility kind/knowledge assortment mediums, designed particularly to substantiate solely important knowledge is collected, processed and saved?
3. Have you learnt if a retention coverage is being utilized i.e. this private knowledge is being erased as soon as the aim of processing is full?
4. Do you may have a process in place, or may you fulfill a request from a buyer to limit the processing of beforehand obtained knowledge, that’s not thought of mandatory for the aim of processing knowledge?
5. How are you ready to steadiness the requirement to solely acquire/course of knowledge that’s restricted to the aim of processing, in opposition to different conflicting items of laws?
6. Are you and your workers geared up to determine info that’s obtained, but not mandatory for the aim of processing, and delete or stop the recording this info, for instance, knowledge revealed throughout a recorded phone dialog with a buyer, or notes made throughout a buyer evaluate, however upon reflection aren’t required?
7. The place extreme knowledge is famous as being current, but is embedded inside different related textual content or info, do you may have strategies of eradicating or redacting the pointless knowledge? (Lord Sugar cheque as a foul instance of redaction)
8. Do you align your knowledge assortment and processing procedures in opposition to the lawful causes of processing, i.e. to serve a authorized or contractual obligation or being within the important pursuits of the person?

The next questions relate to the rights of people whose private knowledge is processed by your workforce

The next questions relate to private knowledge breaches

1. Does your workforce have programs, procedures and coaching to recognise private knowledge breaches?
2. Does your workforce know when and whom to report private knowledge breaches inside our Firm?
3. Does your organization have an information breach response protocol, with consideration given to the next?
   1. Recording the date, time and placement of the breach and the date, time and placement of when the breach was recognized
   2. Recording the date and time that the suitable breach notification process was invoked, together with when a response protocol was initiated, equivalent to response efforts
   3. When to alert related personnel (together with any exterior) to start executing breach response protocols
   4. Provoke related inner and exterior (knowledge topics, media and so forth) communications, the place mandatory being suggested by your authorized and press departments. Keep in mind what’s or is not mentioned can have an effect in your repute
   5. Safe any affected IT programs to protect proof and await any forensic evaluation groups required
   6. Learn how to minimise knowledge loss/breaches and stop additional loss/breaches
   7. Interview these concerned in discovering the breach
   8. Report back to the police if mandatory
   9. Report back to the information safety supervisory authority (inside 72 hours of breach prevalence)
   10. Notifying senior administration/board
   11. Hold each step documented
   12. At completion, debrief the response protocol to make sure it was environment friendly, enough and match for goal.
   13. Testing of the breach response protocols with a “mock” breach incident

The next questions relate to the usage of contractors or vendor suppliers

1. Does your organization use any contractors or vendor suppliers?
2. Is any buyer knowledge transferred to, or accessible by these contractors or vendor suppliers?
3. As a part of your procurement course of, does your organization study the provider’s knowledge safety coverage?
4. Who in your organization critiques such a coverage? Are they skilled and sufficiently certified to take action?
5. Is there an information breach indemnity between your two corporations? In whose favour does the indemnity run?
6. Does your organization have agreed on protocols with the contractor or vendor provider, detailing your expectations regarding knowledge minimisation?
7. Does your organization have agreed on protocols with the contractor or vendor provider, detailing your expectations regarding how they might execute an information processing restriction?
8. Does your organization have agreed on protocols with the contractor or vendor provider, detailing your expectations regarding how they might execute an information objection discover?
9. Does your organization have agreed on protocols with the contractor or vendor provider, detailing your expectations regarding how they might execute a proper to be forgotten?
10. Is your contractor or vendor provider positioned abroad? What’s the adequacy of the information safety regime in that nation?
11. Is your organization the information processor? In that case, are you clear on the necessities of your appointing knowledge controller?
12. Do your contracts with the contractors or vendor suppliers (or your appointing knowledge controller) require updating?
13. Does your organization run any formal high quality assurance programmes in opposition to the revealed knowledge safety coverage of the contractor or vendor provider?
14. Does your organization run casual high quality assurance testing of the contractor or vendor provider knowledge safety procedures, equivalent to thriller procuring?
15. Has your organization agreed on an information retention and knowledge destruction coverage with the contractor or vendor provider?
16. Does the contractor or vendor provider’s IT system permit for knowledge portability?
17. Is there a proper contract/processing evaluate in place?

The next questions relate to your HR division

1. Is your HR division conscious that every worker is an information topic and that GDPR applies to the gathering, processing, storage and deletion of worker knowledge in addition to buyer knowledge?
2. Has your HR division mapped workers knowledge in the identical method as this questionnaire requires for buyer knowledge? I.e. an information topic’s rights, use of third-party contractors, minimisation of knowledge, rights to object or prohibit and so forth.?
3. Are staff supplied with a good processing discover?
4. Are staff capable of object to their knowledge being despatched abroad to a father or mother or related firm with the group?
5. Will your organization want to make use of binding company guidelines for worker knowledge processing?
6. Will contracts of employment require modification?
7. Will your HR division must receive revised processing consent for all current and previous staff – keep in mind, they’re thought of to be processing knowledge even when they’re solely storing it
8. Does or will your HR division view, use or take into account the content material on staff’ or future staff’ social media websites, for functions equivalent to checking the legitimacy of sick days, or assessing character suitability for a job?
9. Do your workers employment contracts permit for social media knowledge for use for business functions?
10. Do your job utility types or related important literature require consent from a possible worker to evaluate their social media websites, and to make use of any info contained therein as a part of the recruitment course of?

The next questions relate to the switch of buyer knowledge or processing of it abroad.

1. Does your organization switch any buyer knowledge abroad?
2. If sure, is the nation of receipt throughout the EU?
3. Does your organization use any contractor or vendor suppliers?
4. Does that firm switch buyer any knowledge abroad?
5. If sure, is the nation of receipt throughout the EU?
6. Are binding company guidelines utilised?
7. By what technique is the shopper knowledge transferred abroad?
8. Are acceptable sturdy encryption controls utilised?
9. Is buyer consent at all times sought and obtained earlier than any abroad switch of knowledge exists, i.e. by a good processing discover and consent declaration?
10. What programs and controls exist round transfers of knowledge abroad and which suitably skilled and certified particular person critiques and authorises these controls?