0 of 41 items completed 0%
Lawful Basis & Consent Lawful basis for processing identified and documented for each data processing activity Consent mechanisms are granular, specific, and freely given — no bundled consent Consent records are stored with timestamp, version of privacy notice, and channel Withdrawal of consent is as easy as giving it — opt-out mechanisms tested Legitimate interest assessments (LIAs) documented where legitimate interest is relied upon Special category data processing has explicit consent or a documented exemption
Privacy Notices & Transparency Privacy notice is written in plain language — tested for readability Privacy notice covers all required elements: controller identity, purposes, legal basis, retention, rights Privacy notice is easily accessible at all data collection points Privacy notice is reviewed and updated at least annually Layered privacy notices used where appropriate for complex processing Children's data processing — age verification and parental consent mechanisms in place if applicable
Data Subject Rights Process in place to handle Subject Access Requests (SARs) within the legal deadline Process in place to handle right to erasure requests Process in place to handle data portability requests Process in place to handle objection to processing requests Process in place to handle rectification requests All rights requests logged and tracked with response times measured Staff trained on how to identify and handle data subject rights requests
Data Minimisation & Retention Data minimisation principle applied — only data necessary for the stated purpose is collected Retention schedule documented for all data categories Automated deletion or anonymisation processes in place for expired data Retention schedule reviewed at least annually Backup and archive data included in retention schedule Data collected for research or analytics is anonymised or pseudonymised where possible
Data Transfers & Third Parties All third-party processors identified and documented Data Processing Agreements (DPAs) in place with all processors International data transfers assessed — appropriate safeguards in place (SCCs, adequacy decisions) Sub-processor list maintained and updated Third-party processors audited or assessed at least annually Vendor contracts include data breach notification requirements
Privacy by Design & DPIAs Privacy by design embedded in the product development and change management process Data Protection Impact Assessments (DPIAs) conducted for high-risk processing activities DPIA register maintained and reviewed Data Protection Officer (DPO) consulted on high-risk processing Privacy risk included in the enterprise risk management framework
Breach Management Data breach response plan documented and tested Breach notification process meets the 72-hour regulatory deadline Breach log maintained with all incidents — including near-misses Staff trained to identify and report potential data breaches Post-breach review process in place to prevent recurrence