Please read through the assesment guidelines before starting. Thanks !  

  
Framework Sections, Control Objectives, Controls & Tests  
Section  	0 Management and Steering 	
   
  	Control Objective  	PPO 	Privacy Policy 	 	
  	The entity establishes and communicates a policy that states its objectives and responsibilities regarding privacy and is in line with accepted privacy principles and applicable laws and regulations. 	
  	
  	Control 	PPO01 	Privacy Policy setup, communication and reviews 	
  	A documented privacy policy, which has been communicated to internal personnel and external stakeholders, has been established and is reviewed and approved annually by management.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PPO02 	Management commitment engagement 	
  	Management expresses its (responsibility for) commitment to solid and lawful privacy principles.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PPO03 	Privacy Policy objectives 	
  	The privacy policy states the objectives of the entity regarding privacy and personal data protection (see also DMI02, ULI02)
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PPO04 	Personal data processing rules 	
  	a) For every instance of processing personal data, the entity establishes alignment with accepted and legal privacy principles, and documents the way in which adherence with these principles is achieved.
C
b) For every instance of processing personal data, the entity makes sure that documented instructions are in place for each processing activity from contractual partners (controllers or (other) processors).
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PPO05 	Establishing criteria that demonstrate lawful processing 	
  	The entity has established and documented the criteria that demonstrate lawful processing for each instance of personal data processing.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	RRE 	Definition of roles and responsibilities 	 	
  	The entity establishes and implements clear roles and responsibilities regarding the safeguarding of personal data and the achievement of privacy objectives. 	
  	
  	Control 	RRE01 	Definition of Processor/Controller roles 	
  	For every personal data processing operation, the entity establishes and documents whether it operates as controller or processor.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RRE02 	Replaced by RRE03(b). 	
  	Replaced by RRE03(b). 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RRE03 	Controller/Processor agreements 	
  	a) Where the entity operates as a controller, it establishes agreements with processors that govern the privacy responsibilities of the processor. If the entity operates as a joint controller, an arrangement with the other controller is in place.
C
b) Where the entity operates as a processor, agreements with the controllers are in place that govern the privacy responsibilities of the processor. If processing is subcontracted to another processor, agreements are in place that govern the privacy responsibilities of the (sub)controller.
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RRE04 	Data protection related coordination 	
  	The entity assigns coordination, oversight and monitoring of privacy to a designated person, such as a privacy officer or Data Protection Officer (DPO). The responsibility, authority, and accountability of the designated person are clearly documented and regularly reviewed.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RRE05 	Individual staff roles and responsibilities 	
  	The roles and responsibilities of individual staff in safeguarding personal data and compliance with privacy principles are established and communicated.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	PDI 	Personal Data Identification and classification 	 	
  	The entity understands and documents which personal data is stored and processed and identifies and treats personal data appropriately. Measures to safeguard personal data take into account the differences in sensitivity in personal data, leading to identification of risks and compliance with laws and regulations. 	
  	
  	Control 	PDI01 	Personal Data Identification documentation 	
  	The entity deploys a documented process to identify and document processing of personal data and classifying that data as such. This includes processes, systems and third parties that handle personal data.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PDI02 	Special category documentation 	
  	The entity clearly distinguishes and documents processing of (a) personal data and (b) special categories of personal data.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PDI03 	Special category processing procedures 	
  	The entity deploys a procedure to assess whether existing or planned processing of personal data involves special categories of personal data. If so, it explicitly assesses and documents the lawfulness of (planned) processing and takes mitigating measures to ensure secure and compliant processing.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PDI04 	Data processing recording practices 	
  	(a) The entity maintains and manages a systematic record of personal data processing activities including the characteristics of these activities (legitimate basis, purpose, categories of data and data subjects, recipients, security measures).
C
(b) The entity maintains and manages a systematic record of personal data processing activities performed on behalf of each controller including the characteristics of these activities (contact details of controller, transfers, security measures).
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	RMA 	Risk Management 	 	
  	The entity systematically and periodically identifies, assesses, and mitigates factors that endanger the achievement of privacy objectives. 	
  	
  	Control 	RMA01 	Risk Management process definition 	
  	A process is in place to periodically:
a. identify the events and factors endangering privacy objectives;
b. assess the impact and probability of these events, and to subsequently formulate adequate risk responses and control measures.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RMA02 	Integrated in RMA01. 	
  	Integrated in RMA01. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RMA03 	Risk behaviour change reaction 	
  	When new or changed privacy risks are identified, the privacy risk assessment and the risk response strategies are reviewed and updated where needed.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RMA04 	Risk acceptance/appetite documentation  	
  	Privacy risk acceptance criteria are established, approved, documented, and applied.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	RMA05 	Risk mitigation control documentation 	
  	The entity plans and implements the controls that are necessary to mitigate privacy risk. Progress of implementation is monitored and measured.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	PIA 	Data Protection Impact Assessments 	 	
  	The privacy-related impact of new products and services and their use within the entity is systematically identified, assessed and addressed. 	
  	
  	Control 	PIA01 	Data Processing Impact Assessment (DPIA) definition 	
  	The entity deploys a documented process to carry out an assessment of the impact on privacy regarding new or significantly changed processes, products and services (DPIA).
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIA02 	DPIA scope completeness 	
  	The DPIA takes into account:
a. the envisioned processing operations;
b. their purpose, necessity, and proportionality;
c. the risks they present to data subject privacy;
d. the measures to mitigate these risks.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIA03 	Integrated with PIA02. 	
  	Integrated with PIA02. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIA04 	Stakeholder and Authority involvement 	
  	All relevant stakeholders are involved in the DPIA, and specific guidelines of the supervisory authority regarding assessment criteria are adhered to.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIA05 	System/Software processing documentation 	
  	The entity documents all systems and software that process personal data and a history of changes applied to them.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIA06 	DPIA result change process approach 	
  	A change management process is established to implement approved privacy measures from the DPIA before the change is executed.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	PIB 	Privacy Incident and Breach Management 	 	
  	The entity adequately detects and handles privacy-related incidents; privacy-related incidents are responded to appropriately as to limit the consequences and to take measures to prevent future breaches. 	
  	
  	Control 	PIB01 	Incident and Breach process approach 	
  	A formal, comprehensive privacy incident and breach management process has been implemented, which specifies the following:
a. The responsibilities of staff members to inform the responsible privacy officer or DPO in case of a privacy incident or possible data breach;
b. The privacy officer or DPO (or, if applicable, security officer) assesses whether the incident is privacy related. In case of a personal data breach, the privacy officer documents the nature of the breach, the consequences, and the approximate number of data records and data subjects affected.
c. The privacy officer or DPO initiates and coordinates required actions, and determines the required involvement of individuals and stakeholders to be informed (such as the controller in case the entity is a processor or the supervisory authority if the entity is the controller).
d. The privacy officer or DPO monitors the progress of remediating actions and reports to management (and, if applicable, informs the controller and the supervisory authorities).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB02 	Integrated in PIB06. 	
  	Integrated in PIB06. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB03 	Incident/Breach escalation procedures 	
  	The process includes a clear escalation path, based on the type or severity (or both) of the incident, up to legal counsel and executive management. The process addresses the criteria for contacting law enforcement, regulatory, or other authorities.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB04 	Privacy breach notification policy 	
  	(a) The entity has a privacy breach notification policy that ensures that the supervisory authority is timely notified of the data breach if the breach is likely to result in a risk to the rights and freedoms of natural persons.
C
(b) The entity has a privacy breach notification policy that ensures that the respective controller of the processing activity involved is timely notified of a possible data breach.
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB05 	Data breach information collection 	
  	(a) In case of a data breach all required information regarding the breach is collected and provided to the supervisory authority, including cause and mitigating measures.
C
(b) In case of a (possible) data breach all required information regarding the breach is collected and provided to the controller of the processing activity involved, including cause and mitigating measures.
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB06 	Breach management coordination 	
  	The privacy officer or DPO has been assigned the overall responsibility for the breach notification process. The privacy officer documents all considerations made when determining the obligation to notify.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB07 	Breach remediation practices 	
  	The breach management process outlines that the evaluation of incidents or breaches leads to remediations and improvements, and serve as input for staff privacy awareness programs.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB08 	Breach management process scope 	
  	The privacy incident and breach management process outlines the following:
a. after any major privacy incident or data breach, a formal incident evaluation is conducted, where necessary involving external expertise;
b. a periodic review of actual incidents is conducted and required improvements are identified based on the following:
o incident root cause;
o incident patterns;
o changes in the internal control environment and legislation;
c. results of the periodic review and progress of improvements are reported to and reviewed by management.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PIB09 	Breach management process reviews 	
  	The breach management process is reviewed at least every year and shortly after the implementation of significant system or procedural changes.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	SCO 	Staff competencies 	 	
  	Staff in positions with access to or control over personal data and personal data processes have the necessary privacy competences to adequately perform their duties. 	
  	
  	Control 	SCO01 	Data handling documentation for Staff 	
  	The entity documents the required privacy competences for staff that is involved in handling personal data. It also establishes how these competences can be achieved (e.g. training programs).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	SCO02 	Staff privacy competency tracking and training 	
  	The entity documents the extent to which individual staff members possess these competences. A process is in place to bridge competence gaps.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	SCO03 	Staff hiring and onboarding competency controls 	
  	The entity addresses privacy competences in its hiring and onboarding process for staff to be involved in safeguarding personal data and compliance with privacy principles, and addresses privacy performance in individual appraisals.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	SCO04 	Privacy program budgetting 	
  	Management annually reviews the allocation of staff, budgets, and other resources to its privacy program.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	SAT 	Staff awareness and training 	 	
  	Staff is sufficiently aware of privacy laws, regulations and organisational privacy policies and guidelines, and their individual responsibilities with regard to privacy, and the entity engages in programs to establish and maintain awareness. 	
  	
  	Control 	SAT01 	Privacy and security awareness training 	
  	A privacy and security awareness course is organised at least annually for all employees. New employees, contractors, and others are required to complete a comparable training within the first month following employment in order to understand the privacy policy of the entity and its implications.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	SAT02 	Documented scope of training and awareness materials  	
  	o In-depth (internal or external) privacy training is provided based on the necessary privacy competences of staff (see SCO). Training covers privacy and relevant security policies and procedures, legal and regulatory considerations, incident response, and related topics. Such training is required annually for all employees who have access to personal data or are responsible for protection of personal data;
     o tailored to the employee's job responsibilities and required competences.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	SAT03 	Maintenance of training and awareness materials  	
  	Training and awareness courses are reviewed and updated to reflect current legislative, regulatory, industry, and entity policy and procedure requirements.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	LRC 	Legal review of changes in regulatory and/or business requirements 	 	
  	Privacy risks associated with changes to the entity (structure and strategy) and to regulatory requirements are adequately considered. 	
  	
  	Control 	LRC01 	Managing change in regulatory or business requirements 	
  	The entity establishes a process to monitor, assess, and address the impact on privacy requirements from changes in:
a. legal and regulatory requirements;
b. industry requirements, best practices and guidelines;
c. contracts, including service-level agreements with third parties (changes to the privacy and security related clauses in contracts are adequately reviewed and approved before they are executed);
d. business operations and processes;
e. people assigned responsibility for privacy and security matters;
f. technology (prior to implementation).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	1 Notice 	
   
  	Control Objective  	PST 	Privacy  Statement 	 	
  	The entity transparently informs data subjects of the entity's policy, requirements, and practices regarding the collection, use, retention, disclosure and disposal of personal data. 	
  	
  	Control 	PST01 	Privacy Statement scope 	
  	The entity's privacy statement:
a. describes the personal data obtained, the sources of such information, the purposes for which it is collected and the applicable lawfulness criteria;
b. describes the consequences, if any, of the data subject not providing the requested information;
c. describes (if applicable) further processing;
d. provides information on data subject rights and the procedure to exercise these rights (see also URE, DAR, DCR, DDR, DPR).
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PST02 	Privacy Statement must have requirements for Notice 	
  	The privacy statement is:
a. easily accessible and (made) available for data subjects when personal data is first collected from the data subject;
b. provided in a timely manner (that is, at or before the time personal data is collected, or as soon as practical thereafter) to enable individuals to decide whether or not to submit personal data to the entity;
c. clearly dated, to allow data subjects to determine whether the notice has changed since the last time they read it or since the last time they submitted personal data to the entity;
C
d. easily understood and readable.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	2 Choice and consent 	
   
  	Control Objective  	CFR 	Consent framework 	 	
  	The entity obtains data subject's consent for processing personal data where required or necessary. 	
  	
  	Control 	CFR01 	Privacy Statement must have requirements for Choice and Consent 	
  	The entity's privacy statement describes, in a clear and concise manner, the following:
a. the choices available to the data subject regarding the collection, use, and disclosure of personal data;
b. the process a data subject should follow to exercise these choices (for example, checking an opt out box to decline receiving marketing materials);
c. the ability of, and process for, an individual to change contact preferences;
d. the consequences of failing to provide personal data required for a transaction or service;
e. the consequences of refusing to provide personal data (for example, transactions may not be processed);
f. the consequences of denying or withdrawing consent (for example, opting out of receiving information about products and services may result in not being made aware of sales promotions).
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	CFR02 	Subject consent processing 	
  	If processing is based on data subject''s consent, the entity:
a. obtains and documents a data subject's consent in a timely manner (that is, at or before the time personal data is collected or soon after);
b. confirms an individual's preferences (in writing or electronically);
c. documents and manages changes to an individual's preferences;
d. ensures that an individual's preferences are implemented in a timely fashion;
e. retains information to be able to demonstrate given consent.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	
   
  	Test Ref. 	Name 	Description 	??? 	
  	DPP1.1 	Processing details communication 	Has the data subject been informed of the processing? 	 	
  	
  	Control 	CFR03 	Processing of special category personal data for consent 	
  	The entity does not collect or process special categories of personal data, unless it has a lawful basis to do so.
If explicit consent of the data subject is the lawful basis for processing special categories of personal data, the data subject has affirmatively agreed, through some action, to the use or disclosure of the special categories of personal data. The entity obtains explicit consent directly from the data subject and documents/retains evidence of the data subject's consent, for example, by requiring the individual to check a box or sign a form.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	CFR04 	Consent withdrawal facilitation 	
  	In case of processing of personal data on the basis of data subject's consent, the entity will facilitate the data subject in exercising its right to withdraw consent at any time.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	3 Collect 	
   
  	Control Objective  	DMI 	Data Minimisation 	 	
  	Personal data is adequate, relevant, and limited to what is necessary in relation to the legitimate purposes for which it is processed. 	
  	
  	Control 	DMI01 	Data collection rules in processes and procedures 	
  	The entity establishes a process and procedures to:
a. identify the extent to which personal data is essential for the purposes of the entity's processing, and to differentiate it from optional personal data;
b. limit processing of personal data to the minimum extent required by the processing purposes;
c. periodically review the continuing necessity of personal data in the entity's products and/or services.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DMI02 	Minimisation statement formalisation requirement 	
  	The privacy policy states data minimisation as a privacy principle for the entity (see PPO). 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	4 Use, store, and dispose 	
   
  	Control Objective  	ULI 	Purpose limitation 	 	
  	Personal data is not disclosed, made available or otherwise used for other purposes than those specified in the entity's privacy statement except:
a) with the consent of the data subject; or
 b) by the authority of law. 	
  	
  	Control 	ULI01 	Data utilisation limitation 	
  	The entity establishes a process and procedures to:
a. limit disclosure and use of personal data to the legitimate purposes as documented in the entity's privacy policy and privacy statement;
b. continuously assure that disclosure and use of personal data are in agreement with the data subject's consent and applicable laws and regulations.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ULI02 	Purpose limitation formalisation 	
  	The privacy policy states purpose limitation as a privacy principle for the entity (see PPO).
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	PBD 	Privacy architecture (Privacy by Design and Privacy by Default) 	 	
  	The entity takes into account solid privacy policies, principles, and/or applicable laws and regulations when designing or changing products, services, business systems or processes. 	
  	
  	Control 	PBD01 	Embedding rights and choices in client workflows 	
  	When developing, designing, selecting and using applications, services and products that process personal data, the entity takes into account the privacy principles and privacy risks as early as possible in the design phase. The risk of conflicts between the privacy design and the rights and freedoms of data subjects (and the entitys privacy policy) is identified and addressed. If the entity procures services of third parties in these activities, it will require these third parties to deploy the same privacy risk management activities.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PBD02 	Privacy risk assessment embedding in projects 	
  	Assessment of privacy risks is an inherent and documented element of the entity's project methodology and/or design and development process.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	PBD03 	Default settings of client interface choices 	
  	Where the systems, services and products that process personal data offer privacy-related choices and options, the default setting for these choices and options will be as restrictive as possible in terms of privacy.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DRE 	Data retention 	 	
  	Personal data is retained no longer than the minimum time needed, as required by applicable laws and regulations, or for the purposes for which it was collected. 	
  	
  	Control 	DRE01 	Data retention practice requirements 	
  	The entity:
a. documents its retention policies and disposal procedures for personal data;
b. ensures personal data is not kept beyond the established retention time unless a justified business or legal reason for doing so exists;
c. for each instance of personal data processing, documents applicable retention times;
d. discloses retention time policies to data subjects in its privacy statement;
e. retains, stores, and disposes archived and backup copies of records in accordance with its retention policies;
f. instructs processor(s) regarding data retention (periods)
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DRE02 	Exceptions for contractual/legal matters 	
  	Legal and contractual retention requirements are considered when establishing retention practices when they may be exceptions to normal policies.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DDA 	Disposal, destruction and anonymisation 	 	
  	Personal data is anonymised and/or disposed of within the entity where required. Identities should not be identifiable and personal data should not be available once it is past its retention date. 	
  	
  	Control 	DDA01 	Requirements for personal data removal 	
  	The entity has a documented process in place that ensures:
a. erasure or destruction of personal data records in accordance with the retention policies, regardless of the nature of storage media (for example, electronic, optical media, or paper based);
b. disposal of original, archived, backup and ad hoc or personal copies of records in accordance with its destruction policies;
c. adequate documentation of the disposal of personal data.
The entity further:
d. within the limits of technology, locates and removes or reduces specified personal data about an individual as required;
e. regularly and systematically destroys, erases, or anonymises personal data that is no longer required to fulfill the identified purposes or as required by laws and regulations.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DDA02 	Contractual considerations for private data removal 	
  	Contractual requirements are considered when establishing disposal, destruction, and reduction practices if they may result in an exception to the entitys normal policies.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	URE 	Use and restriction 	 	
  	Personal data is not used in case of the restriction of the data subject or in case of specific legal restrictions by local government. Objections to processing by data subject will be handled adequately. 	
  	
  	Control 	URE01 	Integrated in PST01. 	
  	Integrated in PST01.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	URE02 	Response to restriction requests 	
  	The entity has a process in place to adequately respond to data subjects exercising their rights to restriction of processing or to object to processing.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	5 Data Access and Data Quality 	
   
  	Control Objective  	DAR 	Data access requests 	 	
  	Data subject access requests are responded to adequately, and data subjects are able to determine which personal data relating to her/him is processed and in what way. 	
  	
  	Control 	DAR01 	Data access request response procedure 	
  	Procedures are in place to adequately respond to data subject access requests. In case the data subject exercises his/her right, the entity will inform the data subject of the nature of the personal data it processes and the characteristics of the processing (e.g. purpose, recipients, retention times, the existence of automated decision making).
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DAR02 	Integrated in PST01 	
  	Integrated in PST01. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DAR03 	Response implementation recommendation 	
  	The entity has a process in place to timely provide to the data subject, in a commonly used electronic form, a copy of the personal data undergoing processing.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DAR04 	Request identity control 	
  	The entity verifies the identity of the requesting data subject before responding.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DCR 	Data correction requests 	 	
  	Data subject correction requests are responded to adequately, and data subjects are able to determine whether their personal data is correct/up-to-date, and are able to correct their personal data. 	
  	
  	Control 	DCR01 	Correction request procedures 	
  	Procedures are in place to adequately respond to data subject correction requests. In case the data subject exercises this right, the entity will rectify the personal data of the data subject without undue delay.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DCR02 	Integrated in PST01 	
  	Integrated in PST01. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DCR03 	Correction identity controls 	
  	The entity verifies the identity of the requesting data subject before acting on the request.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DCR04 	3rd party correction notifications 	
  	The entity notifies third parties, to whom personal data has been disclosed, of necessary corrections in personal data.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DDR 	Data deletion requests 	 	
  	Data deletion requests are responded to adequately and data subjects are able to have their personal data deleted if applicable criteria are met. 	
  	
  	Control 	DDR01 	Data deletion response procedures 	
  	Procedures are in place to adequately respond to data subject deletion requests (right to be forgotten). In case the data subject exercises his/her right, the entity will validate the grounds of the request against applicable criteria (e.g. processing is consent-based, unlawful processing, purpose no longer valid, legal requirements for retention).
Where a valid ground exists, the entity will erase the personal data without undue delay.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DDR02 	3rd party deletion request notification 	
  	If applicable, the entity notifies other controllers, to whom the personal data has been passed on, of the data subject's request to have personal data deleted. If the personal data are processed by a processor, the entity instructs the processor to delete the data.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DDR03 	Integrated in PST01 	
  	Integrated in PST01. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DDR04 	Data deletion identity controls 	
  	The entity verifies the identity of the requesting data subject before acting on the request.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DPR 	Data portability requests 	 	
  	Data portability requests are responded to adequately and data subjects are able to have their personal data transferred to another entity if applicable criteria are met. 	
  	
  	Control 	DPR01 	Data transfer procedures 	
  	Procedures are in place to adequately respond to data subject portability requests. In case the data subject exercises his/her right, the entity will validate the grounds of the request against applicable criteria (e.g. processing is consent-based, processing is carried out by automated means). Where a valid ground exists, the entity will transfer the personal data without undue delay.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DPR02 	Automatic transfer procedure where feasible 	
  	If technically feasible, the entity will transfer the personal data directly to another (controlling) entity as instructed by the data subject.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DPR03 	Integrated in PST01 	
  	Integrated in PST01. 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DPR04 	Identity verification for transfers 	
  	The entity verifies the identity of the requesting data subject before acting on the request.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	ACD 	Accuracy and completeness of data 	 	
  	Documented procedures for validation, editing and update of personal data assure accurate and complete personal data processing. 	
  	
  	Control 	ACD01 	Data quality validation procedures 	
  	The entity has procedures in place to:
a. edit and validate personal data as it is collected, created, maintained, and updated;
b. record the date when the personal data is obtained or updated;
c. specify when the personal data is no longer valid;
d. specify when and how the personal data is to be updated and the source for the update (for example, annual reconfirmation of information held and methods for individuals to proactively update personal data);
e. indicate how to verify the accuracy and completeness of personal data obtained directly from an individual, received from a third party, or disclosed to a third party;
f. ensure personal data processed is sufficiently accurate and complete to make decisions.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ACD02 	Periodic data quality validation controls 	
  	The entity undertakes periodic assessments to check the accuracy of personal data records and to correct them, as necessary, to fulfill the stated purpose.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	6 Disclose 	
   
  	Control Objective  	TPD 	Third party disclosure and registration 	 	
  	Personal data is not disclosed to third parties without a lawful basis or for other purposes than the data subject was informed about. 	
  	
  	Control 	TPD01 	3rd party disclosure practice 	
  	The entity has procedures in place to:
a. prevent the disclosure of personal data to third parties if there is no lawful basis to do so and/or the data subject has not been informed;
b. document the nature and extent of personal data disclosed to third parties;
c. monitor whether disclosure to third parties is in continuous compliance with the entity's privacy policies and procedures, or is specifically allowed or required by law or regulation;
d. document any third-party disclosures for legal reasons;
e. notify data subjects and obtain their consent prior to disclosing personal data to a third party for purposes not identified in the privacy notice;
f. monitor that personal data is only provided to third parties for purposes specified in the privacy notice.
C 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	TPA 	Third party agreements 	 	
  	Privacy considerations and requirements are adequately covered when procuring (personal data related) solutions or services from third parties resulting in appropriate handling or protection of personal data. 	
  	
  	Control 	TPA01 	Rules for data pricacy with 3rd party involvement 	
  	(a) If the entity procures solutions from third parties/suppliers or outsources processes to service providers, and processing of personal data is (partially) contracted, the entity enters into formal agreements that require from the third party due care and a level of protection of personal data equivalent to that of the entity. In doing so, the entity limits the third partys use of personal data to purposes established by the entity.
C
(b) The entity ensures that subcontracting the processing of personal data to another processor is only done after prior authorisation of the controller. If the controller approves, the entity enters into formal agreements that require from the third party due care and a level of protection of personal data equivalent to that of the entity.
P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	TPA02 	Definition of 3rd party obligations 	
  	The entity ensures that the agreements will also address the following obligations of the third party:
a. confidentiality and non-disclosure;
b. security requirements;
c. cooperation in responding to data subject requests and data subject rights execution;
d. information provision (e.g. in case of planned subcontracting);
e. information provision and cooperation in case of data breaches;
f. retention periods and data deletion;
g. no further subcontracting without permission of the entity;
h. liabilities and indemnifications.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	TPA03 	3rd party agreement compliance follow-up 	
  	The entity evaluates the performance and compliance of third parties using one or more of the following approaches (in ascending order of assurance and depending on the risk profile of the third party):
a. the third party responds to a questionnaire about its practices;
b. the third party self-certifies that its practices meet the entity's requirements based on internal audit reports or other procedures;
c. the entity performs a periodic on-site evaluation of the third party;
d. The entity engages in an audit or assurance assessment
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	DTR 	Data Transfers 	 	
  	ersonal data is not transferred (i.e. movement, viewing, or printing of data in another location) internationally to countries that have an inadequate legal privacy regime. 	
  	
  	Control 	DTR01 	Control security of transfers to 3rd countries/organisations 	
  	The entity has established any instances where personal data under its responsibility is being transferred to and processed in third countries that possibly insufficiently guarantee the privacy rights of data subjects.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	DTR02 	EU adequacy decision regulations 	
  	The entity only transfers personal data to third countries, for which
(a) an Adequacy Decision from the European Commission has been issued, or
(b) a set of appropriate safeguards (e.g. binding corporate rules or adopted standard data protection clauses) has been implemented.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	7 Data Security 	
   
  	Control Objective  	ISP 	Information Security Program 	 	
  	Personal data is adequately secured from accidental errors or loss, or from malicious acts such as hacking or deliberate theft, disclosure or loss. 	
  	
  	Control 	ISP01 	Measures to safeguard personal data security 	
  	The entity has taken appropriate technical and organisational measures to ensure security of personal data. Security comprises confidentiality, integrity, and availability of personal data. Also refer to IAM, STR, ENC, LOG.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP02 	Inclusion in Information Security Management System 	
  	Security of personal data is explicitly addressed in the entity's information security policies and the information security management system.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP03 	Specific privacy related risk assessment controls 	
  	The appropriateness of security measures regarding personal data is established in periodic risk assessments in which all relevant stakeholders take part and in which actual and planned personal data processing is assessed.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP04 	Encryption and pseudonymisation practices 	
  	The entity has a documented policy on encryption and pseudonymisation of personal data and systematically verifies adherence to the policy (also refer to ENC).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP05 	Regular controls of protection measures adequacy 	
  	The entity regularly tests, assesses and evaluates the effectiveness of technical and organisational security measures to ensure an adequate level of personal data security and to identify and initiate improvements.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP06 	Appropriate level of personal data security demonstration 	
  	The entity has an active stance towards deploying a code of conduct (from associations or industry bodies) and/or certifications to demonstrate an appropriate level of personal data security.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ISP07 	Prevention of access to inactive personal data 	
  	The entitys security program prevents access to personal data in computers, media, and paper-based information that are no longer in active use by the organisation (for example, computers, media, and paper-based information in storage, sold, or otherwise disposed of).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	IAM 	Identity and access management 	 	
  	Access rights are appropriately assigned, changed and withdrawn, thus decreasing the likelihood of unauthorised access to, or inappropriate handling of personal data, or data breaches by internal employees, third parties or hackers. 	
  	
  	Control 	IAM01 	Identity and access management requirements 	
  	Systems and procedures are in place to:
a. establish the level and nature of access that will be provided to users, based on the sensitivity of the personal data and the users legitimate business needs to access the personal data;
b. identify and authenticate users, for example, by user name and password, certificate, external token, or biometrics before access is granted to systems handling personal data;
c. require enhanced security measures for remote access, such as additional or dynamic passwords, callback procedures, digital certificates, secure ID cards, virtual private network (VPN), or properly configured firewalls;
d. implement intrusion detection and monitoring systems.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	STR 	Secure transmission 	 	
  	Restricted access to personal data during transmission adequately prevents unauthorised disclosure, breach, altering or destruction of personal data. 	
  	
  	Control 	STR01 	Security requirements for data transmission 	
  	Systems and procedures are in place to:
a. define minimum levels of security for transmission of personal data;
b. employ industry standard encryption technology for transfer and receipt of personal data;
c. assess and approve external network connections;
d. protect personal data in both hardcopy and electronic forms sent by mail, courier, or other physical means;
e. encrypt personal data collected and transmitted wirelessly and protect wireless networks from unauthorized access.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	ENC 	Encryption and end-point security 	 	
  	Encryption assures the prevention of a breach of personal data (accidental loss of personal data, or malicious acts such as deliberate theft, disclosure or loss). 	
  	
  	Control 	ENC01 	Portable media data storage usage controls 	
  	Policies and procedures prohibit the storage of personal data on portable media or devices unless a business need exists and such storage is approved by management.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ENC02 	Data encryption measures 	
  	Policies, systems, and procedures are in place to protect personal data accessed or stored on devices such as:
a. laptop computers, PDAs, smart-phones and similar devices;
b. computers and other devices used by employees while, for example, travelling and working at home;
c. USB drives, CDs and DVDs, magnetic tape, or other portable media.
Such information is encrypted, password protected, physically protected, and subject to the entity's access, retention and destruction policies.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ENC03 	Backup and recovery measures for personal data 	
  	Procedures and systems exist for creation, transfer, storage, and disposal of media containing personal data used for backup and recovery.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	ENC04 	Procedures for portable media swaps, end-of-life, etc 	
  	Procedures exist to report loss or potential misuse of media containing personal data (also refer to PIA). Upon termination of employee- or third-party contracts, procedures provide for the return or destruction of portable media and devices used to access and store personal data, and of printed and other copies of such information.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	LOG 	Logging of access 	 	
  	Access or access attempts to personal data by staff and third parties are logged and investigated to detect and prevent (attempts) to breach security of personal data. 	
  	
  	Control 	LOG01 	Measures to control data access and breach attempts 	
  	Systems and procedures are in place to:
a. manage logical and physical access to personal data, including hard copy, archive- and backup copies;
b. log and monitor access (attempts) to systems with personal data in a logfile with a level of detail and retention time sufficient for the purposes of analysis and investigation;
c. prevent the unauthorised or accidental destruction or loss of personal data;
d. investigate breaches and attempts to gain unauthorized access.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

Section  	8 Monitoring and enforcement 	
   
  	Control Objective  	REV 	Review of privacy compliance 	 	
  	Adequate oversight of the internal organisation and third parties ensures compliance with applicable privacy laws and regulatory requirements and decreases the risk of data breaches or loss of personal data. 	
  	
  	Control 	REV01 	Practices for health checks of privacy compliance 	
  	Systems and procedures are in place to:
a. annually review compliance with privacy policies and procedures, commitments and applicable laws, regulations, service level agreements, standards adopted by the entity, and other contracts;
b. document periodic reviews, for example, internal audit plans, audit reports, compliance checklists, and management sign-offs;
c. report the results of the compliance review and recommendations for improvement to management, and implement a remediation plan;
d. monitor the resolution of issues and vulnerabilities noted in the compliance review to ensure that appropriate corrective action is taken on a timely basis (including revision of privacy policies and procedures, where necessary).
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

   
  	Control Objective  	MON 	Periodic monitoring on privacy controls 	 	
  	Systematic and periodical assessments of privacy processes and controls assure that they operate as designed, resulting in ongoing compliance with applicable laws and regulatory requirements. 	
  	
  	Control 	MON01 	Monitor operational effectiveness of privacy controls 	
  	Management of the entity reviews the following to ensure operational effectiveness of privacy controls:
a. control outputs, control reports and deviations;
b. trend analysis;
c. training attendance and evaluations;
d. complaints and their resolutions;
e. internal reviews;
f. internal and external audit reports;
g. independent audit/assurance reports covering privacy controls at service organisations;
h. other evidence of control effectiveness.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	MON02 	Selection of high exposure risk factors to be monitored 	
  	The selection of controls to be monitored, reviewed and/or audited and the frequency and extent with which this is performed are based on the sensitivity of the personal data involved and the risks of possible exposure or loss.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available. 	

  	Control 	MON03 	Practices for remediation and continuous improvement 	
  	The entity deploys a process that ensures that monitoring leads to remediation of shortcomings and continuous improvement.
C, P 	
  	Importance 	Risk Rating 	Risk Conclusion 	Assessment 	Owner 	
  	 	 	 	 	No List Available.