Map the information
List the types of personal data handled, whose data it is, why it is collected and which teams use it.
Identify systems and providers
Note the systems, vendors, storage locations and any cross-border data flows involved. Do not include credentials in an enquiry.
Gather current practices
Collect existing privacy notices, internal policies, retention practices and staff guidance, even if they need updating.
Review enquiry channels
Identify how individuals can ask questions, make access or correction requests, or raise concerns, and who currently receives them.
Plan for incidents
Summarise how staff report a suspected data incident, who assesses it and how management decisions are recorded.
Agree the role
Discuss the named individual, authority, access, availability, public business contact details and escalation arrangements required for the appointment. The organisation retains its legal responsibilities.
This checklist is not a complete compliance programme or personalised professional advice. The applicable requirements and engagement scope must be confirmed for your circumstances.
Explore the related service →