Categories of personal data and data subjects Elements of personal data included within each data category Source of the personal data Purposes for which personal data is processed Legal basis for each processing purpose categories of personal data) Special categories of personal data Legal basis for processing special categories of personal data Retention period Action required to be GDPR compliant? List the categories of data subjects and personal data collected and retained e.g. current employee data; retired employee data; customer data (sales information); marketing database; CCTV footage. List each type of personal data included within each category of personal data e.g. name, address, banking details, purchasing history, online browsing history, video and images. List the source(s) of the personal data e.g. collected directly from individuals; from third parties (if third party identify the data controller as this information will be necessary to meet obligations under Article 14). Within each category of personal data list the purposes for the data is collected and retained e.g. marketing, service enhancement, research, product development, systems integrity, HR matters, advertising. For each purpose that personal data is processed, list the legal basis on which it is based e.g. consent, contract, legal obligation (Article 6). If special categories of personal data are collected and retained, set out details of the nature of the data e.g. health, genetic, biometric data. List the legal basis on which special categories of personal data are collected and retained e.g. explicit consent, legislative basis (Article 9). For each category of personal data, list the period for which the data will be retained e.g. one month? one year? As a general rule data must be retained for no longer than is necessary for the purpose for which it was collected in the first place. Identify actions that are required to ensure all personal data processing operations are GDPR compliant e.g. this may include deleting data where there is no further purpose for retention.
Legitimate interest based data processing If legitimate interest is a legal basis on which personal data is processed, has an appropriate analysis been carried out to ensure that the use of this legal basis is appropriate? That analysis must demonstrate that 1) there is a valid legitimate interest, 2) the data processing is strictly necessary in pursuit of the legitimate interest, and 3) the processing is not prejudicial to or overridden by the rights of the individual. Data subject rights Question Yes No Comments/ Remedial Action Access to personal data (Article 15) Is there a documented policy/procedure for handling Subject Access Requests (SARs)? Is your organisation able to respond to SARs within one month? Data portability (Article 20 and further guidance available on GDPRandYou.ie) Are procedures in place to provide individuals with their personal data in a structured, commonly used and machine readable format? Deletion and rectification (Articles 16 and 17) Are there controls and procedures in place to allow personal data to be deleted or rectified (where applicable)? Right to restriction of processing (Article 18) Are there controls and procedures in place to halt the processing of personal data where an individual has on valid grounds sought the restriction of processing?