Legitimate interest If legitimate interest is a legal basis on which based data processing personal data is processed, has an appropriate analysis been carried out to ensure that the use of this legal basis is appropriate? That analysis must demonstrate that 1) there is a valid legitimate interest, 2) the data processing is strictly necessary in pursuit of the legitimate interest, and 3) the processing is not prejudicial to or overridden by the rights of the individual. Data subject rights Question Yes No Comments/ Remedial Action Access to personal data Is there a documented policy/procedure for (Article 15) handling Subject Access Requests (SARs)? Is your organisation able to respond to SARs within one month? Data portability (Article Are procedures in place to provide individuals 20 and further guidance with their personal data in a structured, available on commonly used and machine readable format? GDPRandYou.ie) Deletion and Are there controls and procedures in place to rectification (Articles 16 allow personal data to be deleted or rectified and 17) (where applicable)? Right to restriction of Are there controls and procedures in place to processing (Article 18) halt the processing of personal data where an individual has on valid grounds sought the restriction of processing?
Legitimate interest based data processing If legitimate interest is a legal basis on which personal data is processed, has an appropriate analysis been carried out to ensure that the use of this legal basis is appropriate? That analysis must demonstrate that 1) there is a valid legitimate interest, 2) the data processing is strictly necessary in pursuit of the legitimate interest, and 3) the processing is not prejudicial to or overridden by the rights of the individual. Data subject rights Question Yes No Comments/ Remedial Action Access to personal data (Article 15) Is there a documented policy/procedure for handling Subject Access Requests (SARs)? Is your organisation able to respond to SARs within one month? Data portability (Article 20 and further guidance available on GDPRandYou.ie) Are procedures in place to provide individuals with their personal data in a structured, commonly used and machine readable format? Deletion and rectification (Articles 16 and 17) Are there controls and procedures in place to allow personal data to be deleted or rectified (where applicable)? Right to restriction of processing (Article 18) Are there controls and procedures in place to halt the processing of personal data where an individual has on valid grounds sought the restriction of processing?
GDPR-Checklist-Templates-for-SMEs-Downloadable.docx