Section 1: Basics

Has your business documented information about the personal data you hold?

Section 2: Accountability and governance

Does your business have a data protection policy?

Have you nominated a Data Protection Officer (DPO)?

Has the Senior Management Team made data protection important to the organisation?

Have you completed a risk assessment looking specifically at how you manage your data?

Have you looked at your IT systems and processes to ensure they are secure or made changes where necessary?

Has your business trained all staff on data protection rules and procedures?

If you use another company to process your data on behalf of your customer, has your company got written authorisation from the data controller?

If your business operates outside the EU, have you got a representative within the EU?

Have you setup processes to identify, report, manage and resolve any personal data breaches?

Section 3: Individual rights

Have you got processes to handle complaints, requests for information or SARS?

Do you have processes to ensure that the personal data you hold remains accurate and up to date?

Do you have a data retention policy?

Do you have a process to stop the processing of specific personal data?

Do you have a process to supply of the personal data you process in an electronic format?

Section 4: Data security

Does your business have an information security policy supported by appropriate security measures?