Data protection: start from a defensible draft.

Connect purpose, data, data subjects, recipients, legal basis, deletion, technical and organisational measures, risk and owner.

Typical owner: Processing activity owners · Based on: EU, KaitoSec

Check indicators of a likely high risk in a traceable way and document the decision.

Typical owner: Project or process lead · Based on: EU, DSK, ISO, KaitoSec

Review role, contract, technical and organisational measures, sub-processors, third countries, incidents, deletion and exit.

Typical owner: Vendor owner & data protection · Based on: EU, DSK, KaitoSec

Bring together end of purpose, retention, start of the deadline, deletion procedure, system and evidence.

Typical owner: Data and system owners · Based on: EU, KaitoSec

Track intake, identity verification, systems, decisions, deadlines and response status in a controlled way.

Typical owner: Data protection coordination · Based on: EU, EDPB, KaitoSec

Capture, contain and assess data protection incidents in a structured way and escalate them ready for decision.

Typical owner: Incident lead & data protection · Based on: EU, EDPB, KaitoSec