This form consists of one details page plus one page for each of our easy to understand 8 Privacy Promises. For each Privacy Promise we ask you 3 multiple choice questions. Choose the answers that best match where your organisation is on its privacy journey. It should take you no more than 10 minutes to complete, after which we will send you your personalised summary report. Step 1 of 9 – Your information 11% Your detailsName(Required) First Last Email(Required) Company(Required)RoleWe use the details above to send you your personalised report. We also use them to send you our monthly newsletter (you can opt out of this at any time). We don’t use the details for anything else. We are a privacy company after all! Promise 1: AwarenessQ1.1 Have all your staff received data protection training?(Required)For example, do you provide: – general GDPR training for all employees? – security training? – refresher training? Is it recorded/can you demonstrate it? We have never done any data protection training. I think that we did give some data protection training to staff a while ago, but I’m not sure whether everyone is trained. We give every member of staff basic data protection training when they join the organisation. We have done data protection training and security training and attendance will be recorded somewhere. Yes, we have a rolling programme of data protection and security training which we record and can easily demonstrate. Q1.2 Do you have a clear, practical, easy to follow plan which enables you to establish, maintain and demonstrate your data protection compliance? If so, what does that look like?(Required)Some questions to make you think: – Do you have buy in and support from across the leadership team? – Are you able to delegate compliance tasks such as audits and track responsibility? – Is compliance with your plan recorded/can you demonstrate it? There is no plan. I think that we got someone to take care of this some time ago. I’ll be able to find the policies somewhere. We have a person that takes care of this and they will have a plan. We let them get on with it. We have a plan, we did a lot of work on this some time ago, but it is probably not up to date. We have a plan, it is promoted and supported by our leadership team, it involves a group of people in our organisation and it is updated regularly. Let me show it to you. Q1.3. What documentation do you have in place which enables you to demonstrate that your staff understand data protection and care about it?(Required)For example: – do your have a ‘Staff Privacy Pledge’ (or similar) where each of your staff promise to respect data protection laws? – do you have a Tech Use and Confidentiality Policy (or similar) which instructs your staff on how to use, for example, laptops, mobile phones and cloud applications? – do you have a ‘Board Awareness and Buy-in Document’ (or similar) by which the leadership team commit to embedding privacy compliance in the culture of the organisation? None. We have a privacy policy. We got some policies drafted a while ago. We do have a number of very good data protection policies, but I’m not sure that people read them. We have a whole suite of engaging, easy to understand documentation, posters and videos which make our staff understand and care about data protection. We make this stuff fun! Promise 2: InventoryQ2.1. Have you conducted an audit of all the personal information you collect and process and is this updated regularly?(Required) We have never audited what personal data we process. I think that someone in IT did this some time ago, but I’m not confident that it captured information from every department. We definitely did an audit, but I’m not confident that it is in the right format to comply with the law and I’m not sure everyone was involved, or that it is up to date. We did a good job of this some time ago, but we don’t have a process to keep it under review and I’m not sure that everything is up to date. Yes, we have gone through a widespread data audit and have accurate records which we update regularly and can easily demonstrate. Do I get a prize? Q2.2. Do you have data flow diagrams and an Article 30 Record / Record of Processing Activities (ROPA) to show how you process personal information during its entire lifecycle?(Required)Some additional questions to make you think: – Do you keep them updated, accurate and up to date? – Do you update other policies when the data flow diagrams and Article 30 Record / ROPA are updated? We don’t have any of this. We have a spreadsheet. We have some data flow diagrams and a ROPA, but I’m not confident that enough people were involved in its creation to ensure that it is entirely accurate. We have data flow diagrams and a ROPA which lots of people contributed to, but our process for keeping it up to date and informing other policies could be better. We have detailed data flow diagrams and a ROPA which are accurate and up to date and which when updated result in our other data protection documentation being reviewed and updated. Q2.3. Can you demonstrate that your data flows and Article 30 Record / ROPA are accurate?(Required)For example: – do you have an information classification policy document? – do you have a data retention policy? – do you have a template privacy audit questionnaire? No. We have a spreadsheet. We have a bunch of documents, but I’m not sure that we use them in a way that makes sure that our data flows and ROPA are up to date. We have a whole suite of documentation, but no real process for ensuring that it is kept accurate and up to date. Yes, would you like to see how we do it? Promise 3: TransparencyQ3.1. How confident are you that for each category of personal information you process you have identified the correct legal basis for processing that information?(Required) Not confident at all. Not that confident. Fairly confident. Very confident. Certain. Q3.2. Do your privacy notices accurately reflect how you process personal information?(Required)For example, do you have: – a website privacy notice? – a staff privacy notice? – a recruitment privacy notice? Do you keep them updated and record the changes? No. We have a privacy notice on our website, but I’m not sure how accurate it is as it was done some time ago. We have a good privacy notice on our website for our customers, but I’m not sure whether we have other privacy notices. We have a number of privacy notices, but I’m not sure we have a process to keep them up to date as we change how we process personal information. We have a number of privacy notices which are easy to understand and make it clear what we do with personal information. We update them and record any changes. We love a good privacy notice here! Q3.3. How confident are you that your marketing databases and your marketing practices enable you to market to your target customers within the law?(Required)For example: – Do you have separate marketing and service customer contact lists? – Do you record and document your practices? – How do you manage opt outs? Not confident at all. Not that confident. Fairly confident. Very confident. Certain. Promise 4: Safe sharingQ4.1. How would you describe the checks that you make on those organisations that you share personal information with?(Required)For example: – Do you carry out audits? – Do you repeat the audits at regular intervals? – Can you demonstrate this? Non existent. We answer questionnaires if they are sent to us. We carry out audits prior to sharing personal information, but I can’t be sure that we do it every time. We always carry out audits prior to sharing personal information, but we don’t often repeat them. All organisations are audited, those audits are repeated regularly and we can demonstrate that easily. They have more security than you can throw a stick at! Q4.2. Have you entered into a data processing agreement or data sharing agreement with every third party with which you share personal information?(Required) No. Some of them. Yes, most of them. Yes, I think so. Yes, I’m certain. Would you like to see them? Q4.3. How confident are you that you record and demonstrate that you share personal information safely?(Required)For example: – Do you have a record of who you share personal information with? – Do you have a template risk assessment and due diligence questionnaire? – Do you have a template data processing agreement? – Do you have a template data sharing agreement? Not confident at all. Not that confident. Fairly confident. Very confident. Certain. Promise 5: Rights of individualsQ5.1. Do all your staff know what a subject access request (SAR) is, what it could look like and do you have a process for responding to subject access requests in compliance with applicable privacy laws?(Required) No, hardly any will know what a SAR is. Some will, some won’t. The people who handle personal information have been trained and are aware of what to do with a SAR. We train everybody on what to do with a SAR, but we probably need to update our training and review our processes. Everyone has been trained to spot a SAR and is aware of our process for handling them promptly. We keep that process under review. Q5.2. Do you tell individuals what their rights are under the GDPR and how to exercise them?(Required) No. I think that we have some information on this in our privacy policy on our website. I think so, but we should probably take a look at each time we collect personal information. I’m fairly confident that each time we collect personal information, the individual can easily discover what rights they have in relation to that information. Yes, whenever we ask individuals for personal information, we make sure they know their rights in relation to that information. Q5.3. Do you have template responses to each type of subject access request (SAR) and a record of how you have dealt with them?(Required) No, none at all. We probably have something somewhere. We have some, but we probably only have records in our emails. We do have standard responses and we have some form of record, but it could probably be better. Yes, we have a full suite of template responses which we use in accordance with a written policy which all staff are aware of and all correspondence is recorded. We love to be organised here! Promise 6: SecurityQ6.1. Does everyone in your organisation know what they must do from day to day to prevent a data breach?(Required)For example: – Do they receive security training? – Do they get refresher training? – Is all training recorded? No. We have security policies and tell people to read them. We emphasise the importance of security, we have some policies and we offer some training. We have a suite of policies and structured security training which everyone should take part in. Yes, everyone knows the importance of security, they are trained, they are reminded and all training is recorded. Q6.2. Does everyone in your organisation know what to do if they suspect a data breach and do you have a documented response to a suspected breach including a person responsible for notifying the breach, if required?(Required) No. I think that the IT team has some procedures in place. Everyone knows that they should report a breach to their boss and IT, but I’m not sure we are clear about what happens after that. People have been trained on what to do, there is a policy, but we could probably do with reminding people of what to do on a regular basis. Yes, everyone is trained on what to do, there are policies which clearly state responsibilities and there is a requirement to assess the adequacy of the response after any breach. Q6.3. How confident are you that you can demonstrate and record that you have adequate security?(Required)– Do you have a written information security policy? – Do you keep reports of your penetration testing? Not confident at all. Not that confident. Fairly confident. Very confident. Certain. It’s scary just how much security we have around here. Promise 7: InternationalHint: think about all those online tools you use to host your website, your email, your databases and your documents.Q7.1. Do you have a process which ensures that international transfers of personal information are done safely?(Required) No. We try to make sure that we always have an agreement in place when we share personal information. We have a person that is responsible for taking care of this, but I’d be surprised if we do everything that we should. We have a process and a responsible person and I think that we do a pretty good job. Yes, we have a process that ensures that no personal information is transferred internationally without the necessary agreements being in place, assessments conducted and audits carried out and a process being in place to ensure that the processing out of the country remains safe. Q7.2. How confident are you that you have the correct template contractual documentation for the sharing of personal information internationally and know how to use it?(Required) Not confident at all. Not that confident. Fairly confident. Very confident. Certain, test me! Q7.3. How, what and where do you record what personal information has been shared internationally?(Required) No idea. What we have would be in our shared drive somewhere. We keep it all in one place, but I don’t think that it will be comprehensive, or particularly well organised. We have a dedicated online folder where we share all the documentation we have in place in respect of each international transfer. In a dedicated, simply structured online area where all our privacy compliance documentation is kept and updated. Promise 8: Privacy by design & by defaultQ8.1. Do your staff know what a data protection impact assessment (DPIA) is, do they have a template and do they know when to use it?(Required) No. We have a template somewhere. Our staff have been trained and we have a template and we did a DPIA once or twice. We do use DPIAs, but we should probably use them more often and keep them updated. Yes, they have been trained, we have the necessary templates to use, they know when to use them and we keep them updated. Q8.2. Do your staff understand privacy by design, data minimisation, anonymisation and pseudonymisation?(Required) No, they wouldn’t even know how to spell them. They probably understand the basic idea of privacy by design, but not how to implement it. They understand privacy by design and are aware of the concepts of data minimisation, anonymisation and pseudonymisation. They understand and know what they have to do, but I’m not sure they care or fully put it into practice. Yes, they are trained, they understand, they care, they have access to easy to use resources and they know who to ask if they aren’t sure. Q8.3. Do you have a record of data protection impact assessments (DPIAs) which you have carried out as well as a note of when you have decided not to carry out a DPIA and do you update them regularly?(Required) No, what is a DPIA? We should keep them all in one place, but I’m not sure that we do. All our DPIAs are in the same place so we can find the ones that we have done. Yes, we have a detailed spreadsheet which links out to all the completed DPIAs as well as screening questions that we use to decide whether DPIAs are necessary. Yes, we are all over this and have a process in place to make sure that all DPIAs are recorded, easy to find and regularly updated. CAPTCHA