GDPRHealthTest

Is there a regular discussion on data protection on your management board?
YesNo
Has GDPR been recognised as a challenge to the business?
YesNo
Is there awareness creation towards the employees in your organisation?
YesNo

Not in place: the controle mechanisms are not in place
Initial: the control mechanisms are controlled ad hoc
Standard: the control mechanisms are documented
Defined: the control mechanisms are well documented, communicated and understood
Managed: the control mechanisms are defined & being measured
Optimalized: the control mechanisms are acively measured, evaluated and optimalized

Are proper information security policies and procedures installed?
Not in placeInitialStandardDefinedManagedOptimalized
Are proper data protection policies and procedures installed?
Not in placeInitialStandardDefinedManagedOptimalized
Are there formal mechanisms in place to identify breaches and handle incidents?
Not in placeInitialStandardDefinedManagedOptimalized
Are third parties using the personal data?
Yes, from EU countriesYes, from non-EU countriesNo
Do you have proper contracts with those third parties?
YesNo

Is "Privacy by design" implemented as a standard? *
YesNo
Is there a review procedure during development, testing and delivery of the project?
YesNo
Is a Data Privacy Impact Assessment conducted when necessary?
YesNo

From whom is the personal data processed?
EmployeesCustomersSuppliersChildrenOther
Why is personal data processed?
Employee administrationCustomer administrationLegal obligationMonitoringMarketingProfilingServices to third partiesOther
Is there a clear and accessible processing information given to those individuals?
YesNoOther
Which reasons for processing of this personal data is appropriate in your organisation?
Consent of data subjectNecessary for the performance of a contract
Which data is collected of those persons?
YesNo
What is the source of the data?
YesNo

Is a data protection officer appointed in your organisation?
YesNo
Has your data protection officer another role as well?
ITLegalBusinessother
Is your data protection officer an internal or external resource?
InternalExternal
Has the data protection officer the sufficient power to operate?
YesNo
Can the data protection officer regularly report directly to management?
YesNo