Preparing for the General Data Protection Regulation – Checklist for initial data audit Step Questions Response 1.Personal data Identify: what categories of personal data do we hold? How is personal data stored? How is personal data used? Is data-capture a core activity? How much data is captured? 2. Communicating privacy How do we communicate privacy information? information - reviewing current privacy notices Identify and provide copies of ‘data privacy notices’ policies and procedures e.g. Website privacy notice Client Ts&Cs data privacy clause Data privacy policy (for employees) Employment contract data privacy clause Cyber security policy Any others? 3. Subject access requests What is our current procedure for accessing and vetting relevant information to be disclosed? 4. Lawful basis for Based on the above responses identify: processing personal data the different types of data processing we carry out; and the legal basis for carrying it out (legitimate interests/consent etc)
Preparing for the General Data Protection Regulation – Checklist for initial data audit Step Questions Response 1.Personal data Identify: what categories of personal data do we hold? How is personal data stored? How is personal data used? Is data-capture a core activity? How much data is captured? 2. Communicating privacy information - reviewing current privacy notices How do we communicate privacy information? Identify and provide copies of ‘data privacy notices’ policies and procedures e.g. Website privacy notice Client Ts&Cs data privacy clause Data privacy policy (for employees) Employment contract data privacy clause Cyber security policy Any others? 3. Subject access requests What is our current procedure for accessing and vetting relevant information to be disclosed? 4. Lawful basis for processing personal data Based on the above responses identify: the different types of data processing we carry out; and the legal basis for carrying it out (legitimate interests/consent etc)