1. Does your organization map the flow of data through an information audit and maintain a record of the possession, storage, sharing and processing of personal data?

2. Does your organization identify and document the legal rationale for processing personal data?

3. Does your organization obtain explicit consent from users ?

4. Is there an established procedure regarding obtaining and logging of consent ?

5. Did your organization present any privacy policy to its users in a simple and plain language?

6. Does your organization have a response system for users who request their Data Subject Rights such as Right to Access, or Rectification, Object Processing, Data Deletion etc. ?

7. Does your organization have an appropriate data protection policy?

8. Do you comply with data protection policies and regularly reviews the effectiveness of data handling and security controls?

9. Does your organization have a written contract with any processors you use?

10. Did your organization integrate data protection into its processing activities through suitable technical and organizational measures?

11. Are the staffs in your organization provided regular training and updates to increase data protection awareness?

12. Did your organization establish any policy which sets out when and how a DPIA must be conducted?

13. Does your organization have a DPIA framework which links to your existing risk management and project management processes?

14. Does your organization have a Data Protection Officer (DPO)?

15. Does your organization have an information security policy and have a system to identify, report and resolve personal data breaches?

16. Does your organization have an appropriate level of data protection in a situation when the data is processed by a processor and transferred outside the European Economic Area?