IT Policy □ Data Breach Policy □ Security Policy □ Data Retention Policy □ External Facing policy. (NB. This is not a compliance requirement. However, often the privacy policy will be linked to specific external Privacy Notices which are required to be provided so that further copies can easily be obtained by data subjects if required.) [See □ separate template privacy policy and privacy notices] Privacy Notice For employees, workers, consultants – What privacy notices are used by the and directors □ organisation, do they satisfy the new Privacy Notice For Volunteers – □ requirement of transparency in processing and where are they Privacy Notice For Members – □ featured? Privacy Notice For contractors who are sole – traders/partnerships and detailed corporate CRM systems □ Timing and provision mechanism implemented to ensure privacy notices are sent out either at first point of contact if the personal data is collected directly or at first point of contact/within one month where data is collected indirectly □ Security and IT Physical security review carried out for IT systems Does the organisation have –both and physical systems/records adequate physical and IT security □ procedures to protect personal data Additional security measures implemented to restrict and has it implemented technical and access to personal data to only those who need access. organisational measures to show that □ it has considered and integrated data compliance measures into its data Use of pseudonymisation to protect personal data
IT Policy □ Data Breach Policy □ Security Policy □ Data Retention Policy □ What privacy notices are used by the organisation, do they satisfy the new requirement of transparency in processing and where are they featured? External Facing policy. (NB. This is not a compliance requirement. However, often the privacy policy will be linked to specific external Privacy Notices which are required to be provided so that further copies can easily be obtained by data subjects if required.) □ [See separate template privacy policy and privacy notices] Privacy Notice – For employees, workers, consultants and directors □ Privacy Notice – For Volunteers □ Privacy Notice – For Members □ Privacy Notice – For contractors who are sole traders/partnerships and detailed corporate CRM systems □ Timing and provision mechanism implemented to ensure privacy notices are sent out either at first point of contact if the personal data is collected directly or at first point of contact/within one month where data is collected indirectly □ Security and IT Does the organisation have adequate physical and IT security procedures to protect personal data and has it implemented technical and organisational measures to show that it has considered and integrated data compliance measures into its data Physical security review carried out –both for IT systems and physical systems/records □ Additional security measures implemented to restrict access to personal data to only those who need access. □ Use of pseudonymisation to protect personal data