Definitions as per Data Protection Act 2004

  • A "data controller" means a person who, either alone or jointly with any other person, makes a decision with regard to the purposes for which and in the manner in which any personal data are, or are to be, processed.
  • A "data processor" means a person, other than an employee of the data controller, who processes the data on behalf of the data controller.
  • A "data subject" means a living individual who is the subject of personal data.



General Management

1. Do you have a policy on data protection in your organisation?
Yes No

1.1 How do you judge the policy?

1.2 When was the policy last reviewed?

2. Is the policy adequately resourced, and supported by a management infrastructure that can sustain, monitor and review the Policy and generate reports on its effectiveness?
Yes No

2.1 How well do you think the policy is promoted and supported by management?

3. Is there an identifiable person responsible for data protection within your organisation?
Yes No

3.1 How is that person supported by management for data protection matters?

4. Do all individuals who are authorised to process personal data (e.g. staff) receive appropriate training,instruction or guidance on data protection?
Yes No

4.1 How do you judge the training given?

4.2 Are you confident that all individuals (e.g. staff) who process personal data understand their data protection obligations associated with that processing?

5. If there are contracts associated with the processing of personal data which allow third parties access to personal data, for example data processors, do these specify data protection requirements?


Yes No

6. Is there a folder of documents, or other documentation, which will help to manage and demonstrate compliance with data protection obligations?
Yes No

6.1 What is your view on the quality of the information in the folder or in other documentation?


Lawfulness of Processing

1. Has the full extent of the processing, which is permitted by law and/or regulations, been identified?
Yes No

2. Has proof of lawful processing been retained?
Yes No

Transparency of Processing

1. Are data subjects made aware, before they provide personal data, of why personal data is being collected and which organisations will use their data?


Yes No

2. Are there significant practical or technical difficulties in providing the required information to the data subjects?

Yes No

3. Are there legal reasons for not providing such information?
Yes No

Quality of Personal Data

1. Is personal data assessed as to whether it is ‘adequate, relevant and not excessive’ in the context of each particular purpose?

2. Are there significant practical or technical difficulties in carrying out such assessments?
Yes No

3. Do formal criteria/procedures for the deletion of personal data exist?

Yes No

4. Is personal data assessed for its accuracy and checked whether it is up to date?

5. Are there significant practical or technical difficulties in complying with the above?
Yes No

6. Are there legal reasons for not complying with the above?
Yes No

Security of Personal Data

1. Is there a security policy that covers all aspects of the processing of personal data?
Yes No

1.1 How do you judge the security policy?

1.2 How well is the security policy promoted and supported by management?

2. Do security controls or procedures include measures to ensure the integrity of the personal data and of its processing?
Yes No

3. Do security controls or procedures include measures to permit user identification and authorisation processing?

Yes No

4. Do security controls or procedures include measures to safeguard operating procedures?
Yes No

5. Do security controls or procedures include measures to facilitate the use of encryption?
Yes No

6. Do security controls or procedures include measures to invoke a business continuity/disaster recovery plan?

Yes No

7. Do security controls or procedures include measures to establish adequate audit and monitoring arrangements?

Yes No

8. Do security controls or procedures include measures to safeguard the physical security of the processing environment?
Yes No

9. How physically secure do you consider your processing of personal data to be?

10. Are staff trained in the necessary security controls and procedures?
Yes No

10.1 How do you judge the training given?

11. When did you last receive training/instruction on IT security requirements?

12. Are there significant practical or technical difficulties in forming such a plan?
Yes No

Data Subjects' Rights

1. Do procedures allow for data subjects to be informed of the nature of the processing of personal data, and to receive confirmation as to whether or not personal data about them is processed?

Yes No

2. Do procedures allow data subjects to exercise their right of access to personal data which relate to them?

Yes No

3. Do procedures allow Data Subjects to object to the processing of personal data?
Yes No

4. Are there legal reasons for not complying with the above?
Yes No

5. Do procedures have the capability to correct, block or erase personal data (e.g. in compliance with requests from data subjects and/or from Data Protection Office), and to notify third parties who have received the data subject's personal data?
Yes No


Notifications

1. Has a comprehensive census of the processing of personal data been carried out?
Yes No

2. When was the census carried out?

3. Do procedures anticipate the need to notify details of the processing to the Data Protection Office?
Yes No

4. Are there practical or technical difficulties in providing such notification?
Yes No

5. Are there legal reasons for not providing such a notification?
Yes No

System Design

1. Are data protection considerations taken into account during the development, purchase or acquisition of hardware and software?
Yes No

2. Are changes to the software or processing environment considered in the context of data protection obligations?

Yes No