implemented i.e. binding corporate rules, privacy shield, adequacy decision or appropriate safeguards including data processor contracts □ Data retention, classification and destruction Data Retention Policy and matrix implemented □ Does the organisation have documented data retention periods Data retention periods have been captured in all privacy and are they followed? notices □ Can the organisation distinguish between data held as a data Distinction has been captured in the data mapping controller and data held as a data template/record of processing activities □ processor? Security of data destruction both hard copy and – electronic □ When physical data/records are no longer required, are they securely Security of IT asset destruction □ destroyed? Distinction made between confidential waste and waste □ Training Implementation of a GDPR training programme (train the trainer) □ Do all staff and volunteers receive Future induction GDPR training implemented □ data protection training as part of their induction and at least once Ongoing GDPR refresher training implemented □ every 12 months? Senior management and members of the main board have received training on GDPR □ Do staff processing larger volumes of personal data or special categories Enhanced GDPR Training has been undertaken by of personal data (e.g. health and heavy/frequent personal data users □ disability data for participants or details of any criminal offences) have
implemented i.e. binding corporate rules, privacy shield, adequacy decision or appropriate safeguards including data processor contracts □ Data retention, classification and destruction Does the organisation have documented data retention periods and are they followed? Data Retention Policy and matrix implemented □ Data retention periods have been captured in all privacy notices □ Can the organisation distinguish between data held as a data controller and data held as a data processor? Distinction has been captured in the data mapping template/record of processing activities □ When physical data/records are no longer required, are they securely destroyed? Security of data destruction – both hard copy and electronic □ Security of IT asset destruction □ Distinction made between confidential waste and waste □ Training Do all staff and volunteers receive data protection training as part of their induction and at least once every 12 months? Implementation of a GDPR training programme (train the trainer) □ Future induction GDPR training implemented □ Ongoing GDPR refresher training implemented □ Senior management and members of the main board have received training on GDPR □ Do staff processing larger volumes of personal data or special categories of personal data (e.g. health and disability data for participants or details of any criminal offences) have Enhanced GDPR Training has been undertaken by heavy/frequent personal data users □
41713287-9b55-4454-a8cd-f5050be2e9ec.docx