01. Has your organization mapped the flow of data through an information audit?

02. Does your organization maintain a record of the possession, storage, sharing and processing of personal data?

03. Does your organization have an appropriate data protection policy?

04. Does your organization understand the impact of information and personal data risks and does it have an effective process to manage them?

05. Has your organization appointed a Data Protection Officer (DPO)?

06. Has your organization integrated data protection into its processing activities through suitable technical and organisational measures?

07. Is the organization’s staff provided with regular training and updates to increase data protection awareness?

08. As data is processed only on the documented instructions of a controller, does your organisation and the controller have a written contract that lists out respective responsibilities and liabilities?

09. Before obtaining the services of a sub-processor, did your organization take prior written authorisation from the controller?

10. For obtaining the services of a sub-processor, is there a contract in place with the controller and the sub-processor?

11. If your organization operates outside the EU, have you appointed a representative within the EU in writing?

12. Do you have a data breach response protocol in place?

13. Are personal data breaches identified effectively and reported to your controller?

14. Is there a proper system to respond to a controller's/Data Subject's request for information/Data Subject Requests?

15. Do you have established protocols for home working including the transportation of data to home sites?

16. Has your organization set up an information security policy and proper security measures?