Lawful Basis for Processing

0/5

You have identified a lawful basis for each processing activityYou have documented the lawful basis for each processing activityYou obtain explicit consent where required (consent must be freely given, specific, informed, and unambiguous)You have a process for individuals to withdraw consent easilyYou keep records of consent (who, when, how, what they consented to)

Data Subject Rights

0/7

You can respond to Right of Access (SAR) requests within 1 monthYou have processes for Right to Rectification requestsYou can fulfill Right to Erasure (Right to be Forgotten) requestsYou support Right to Data Portability (providing data in machine-readable format)You have a process for Right to Restrict ProcessingYou can handle Right to Object requestsYou have processes for automated decision-making and profiling objections

Privacy by Design

0/5

Data protection is considered at the design stage of new systems/processesYou only collect data that is necessary (data minimization)You have appropriate data retention periods and delete data when no longer neededYou use pseudonymization or encryption where appropriateYou conduct Data Protection Impact Assessments (DPIAs) for high-risk processing

Documentation & Accountability

0/5

You maintain a Record of Processing Activities (ROPA)You have a documented privacy policy that is clear and accessibleYou have appointed a Data Protection Officer (DPO) if requiredYou have data processing agreements with all processors/sub-processorsYou have documented your data flows (what data, where it goes, who accesses it)

Security Measures

0/5

You have appropriate technical measures (encryption, access controls, firewalls)You have appropriate organizational measures (staff training, policies)You regularly test and evaluate security measuresYou have a data breach notification procedure (72-hour rule for supervisory authority)You can notify affected individuals of breaches without undue delay

International Transfers

0/3

You have identified all international data transfersYou use appropriate safeguards for transfers outside the EEA (SCCs, adequacy decisions)You have documented the legal basis for each international transfer

Website & Marketing

0/5

Your website has a compliant cookie consent bannerYou have an up-to-date privacy policy on your websiteMarketing communications include an unsubscribe optionYou obtain opt-in consent for marketing emailsThird-party tracking tools are disclosed in your privacy policy