Scribd Logo
Upload

Welcome to Scribd!

  • 80 views

    GDPR IRL - Policy Mapping

    Uploaded by

    vicky
    The document lists 39 GDPR requirements and identifies the relevant policy documents, sections of policies, or templates that address each requirement. These include an external privacy notice, GDPR compliance policy, information security policies and procedures, data quality maintenance policies, records retention policies, procedures for various data subject requests, breach notification policies, data protection officer responsibilities, policies on international data transfers, and procedures for de-identifying personal data. The respondent indicates that some requirements like policies for children's data or sensitive data processing may not apply, and refers to sample policies and templates provided to help address the GDPR obligations.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd

    GDPR IRL - Policy Mapping

    Uploaded by

    vicky
    80 views9 pages
    The document lists 39 GDPR requirements and identifies the relevant policy documents, sections of policies, or templates that address each requirement. These include an external privacy notice, GDPR compliance policy, information security policies and procedures, data quality maintenance policies, records retention policies, procedures for various data subject requests, breach notification policies, data protection officer responsibilities, policies on international data transfers, and procedures for de-identifying personal data. The respondent indicates that some requirements like policies for children's data or sensitive data processing may not apply, and refers to sample policies and templates provided to help address the GDPR obligations.

    Original Description:

    GDPR Mapping

    Copyright

    © © All Rights Reserved

    Available Formats

    XLSX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document lists 39 GDPR requirements and identifies the relevant policy documents, sections of policies, or templates that address each requirement. These include an external privacy notice, GDPR compliance policy, information security policies and procedures, data quality maintenance policies, records retention policies, procedures for various data subject requests, breach notification policies, data protection officer responsibilities, policies on international data transfers, and procedures for de-identifying personal data. The respondent indicates that some requirements like policies for children's data or sensitive data processing may not apply, and refers to sample policies and templates provided to help address the GDPR obligations.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    80 views9 pages

    GDPR IRL - Policy Mapping

    Uploaded by

    vicky
    The document lists 39 GDPR requirements and identifies the relevant policy documents, sections of policies, or templates that address each requirement. These include an external privacy notice, GDPR compliance policy, information security policies and procedures, data quality maintenance policies, records retention policies, procedures for various data subject requests, breach notification policies, data protection officer responsibilities, policies on international data transfers, and procedures for de-identifying personal data. The respondent indicates that some requirements like policies for children's data or sensitive data processing may not apply, and refers to sample policies and templates provided to help address the GDPR obligations.

    Copyright:

    © All Rights Reserved
    Download as XLSX, PDF, TXT or read online from Scribd
    Download as xlsx, pdf, or txt
    of 9
    At a glance
    Powered by AI
    The document discusses policies and procedures related to GDPR compliance.

    Reference IDs and data processing activities are repeated on many pages

    Policies for data protection, security, privacy, breaches and more are discussed

    Reference ID Criteria Tie Request Type

    5(1)
    GDPR - 1 24(2) G
    91(1)
    GDPR - 2 5(1) G
    GDPR - 3 5(1) G
    GDPR - 4 5(1) G
    5(1)
    GDPR - 5 G
    30(1)(2)(3)

    6 (4)
    GDPR - 6 13(3) G
    14(4)
    GDPR - 7 5(1) G
    8(2)
    GDPR - 8 G
    12(1)
    9(2)
    GDPR - 9 G
    10 (1)
    GDPR - 10 6(1) G

    5(1)
    GDPR - 11 6(4) G
    25(2)
    35(1)(7)(9)

    6 (4)
    GDPR - 12 7 (1)(2) G
    8 (1)

    7 (3)
    GDPR - 13 18 (1)(3) G
    19
    21(1)(3)(4)

    GDPR - 14 9 G

    12(1)(2)(3)(4)(5)(6)
    GDPR - 15 13(1)(2) G
    14 (1)(2)

    12(1)(2)(3)(4)(5)(6)
    GDPR - 16 22(1)(2)(3)(4) G

    GDPR - 17 12(1)(2)(3)(4)(5)(6) G
    13 (1)(2)
    GDPR - 18 14(3) G
    21(4)
    GDPR - 19 15 (1)(2)(3)(4) G
    16
    GDPR - 20 G
    19
    16
    GDPR - 21 G
    19
    17(1)(2)
    GDPR - 22 19 G

    GDPR - 23 20(1) G
    GDPR - 24 21(2) G
    21(6)
    GDPR - 25 89(2) G

    GDPR - 26 24(3) G

    GDPR - 27 25(1) G

    GDPR - 28 27(1) G

    28(1)(2)(3)(4)(5)(9)
    GDPR - 29 29 G
    32(4)

    GDPR - 30 31(1) G

    GDPR - 31 32(1) G

    33(1)
    GDPR - 32 G
    34(3)
    GDPR - 33 33(5) G

    GDPR - 34 36(1) G

    33(1)(2)(3)
    GDPR - 35 G
    34(1)(2)
    37(1)(5)(7)
    GDPR - 36 G
    38(2)(4)(5)

    GDPR - 37 39(1)(2) G

    GDPR - 38 44-49 G

    GDPR - 39 89(1) G
    Request
    Data Privacy Policies and procedures

    Information security policies and procedures


    Data quality maintenance policies and procedures.
    Data processing procedures (legal basis, Codes of Conduct, policies and other
    measures)
    Personal data inventory / Data Processing Activities Mapping (What personal data is
    held and where)
    Policies and procedures for secondary uses of personal data (legal basis, Codes of
    Conduct, policies and other measures), if applicable.

    Records retention policies and procedures


    Policies and procedures for collection and use of children and minors’ data

    Policies and procedures for collection and use of sensitive personal data (including
    biometric and genetic data)
    Documented legal basis for processing personal data (MSA with Data Controller,
    etc.)
    Please provide the most recent Data Protection Impact Assessment

    **May not be required depending on nature of the processing activity**

    Please provide evidence to support how valid consent is obtained. (How is consent
    obtained from data subjects prior to processing their data?)

    Please provide procedures to evidencing how the entity responds to requests to


    opt-out, restrict or object to processing.

    Data processing activities and classification standards to determine if special


    categories of data are identified (e.g. racial or ethnic origin, political opinions, etc.)
    Data privacy notice that details the organization’s personal data handling practices

    Policies and procedures to review processing conducted wholly or partially by


    automated means.
    Breach notification policy and procedure(to affected individuals) and reporting (to
    regulators, credit agencies, law enforcement) and protocol
    Data Subject Collections Notice

    Polices and procedures to respond to requests for access to personal data


    Policies and procedures to respond to requests and/or provide a mechanism for
    individuals to update or correct their personal data
    Policies and procedures of communicating any rectification of erasure of personal
    data.
    Policies and procedures to respond to requests to be forgotten or for erasure of
    data
    Policies and procedures to respond to requests for data portability
    Data privacy notice integrated into direct marketing
    Data privacy notice integrated into research practices, if applicable.

    Please provide evidence of any privacy certifications currently maintained, if any.


    Please provide evidence to support that Privacy by Design is integrated into system
    and product development.
    Please provide evidence supporting that the responsibility of Data Privacy to a
    designated individual in the EU, should Article 3(2) apply.
    Please provide evidence of the third-party security requirements included in
    executed agreements/contracts with third-parties (e.g., clients, vendors, processors,
    affiliates)

    Policies and procedures to cooperate with supervisory authorities, if not contained


    within previously provided policy.
    Please provide evidence to support that appropriate technical safeguards are in place to
    mitigate the risks that are presented by processing, in particular from accidental or unlawful
    destruction, loss, alteration, unauthorized disclosure of, or access to personal data
    transmitted, stored or otherwise processed.

    Ex. Firewall Configurations, Backup Configurations, Enterprise System Monitoring


    Configurations, System Event Logs, Data Encryption Configurations, etc. )

    Data Privacy Incident Response Policy and Procedures

    Data privacy incidents/breaches log for the review period


    Please provide evidence to support that supervisory authorities are / will be
    consulted prior to processing when the results of the DPIA result in a high risk in the
    absence of measures taken by the controller to mitigate the risk.

    **Only applicable if you are required to complete a DPIA***

    Data breach notification policies and procedures


    Data Protection Officer (DPO) formal assignment, if applicable.

    Data protection officer 's job responsibilities/description including:


    - Privacy training
    -self-assessments of privacy management
    - Enterprise Privacy Risk Assessment
    - ongoing privacy compliance requirements, e.g., law, case law, codes, etc.
    - PIA/DPIA guidelines and templates

    Please provide policies records of the transfer mechanism used for cross-border
    data flows (e.g., standard contractual clauses, binding corporate rules, approvals
    from regulators)

    -Binding Corporate Rules as a data transfer mechanism

    -Contracts as a data transfer mechanism (e.g., Standard Contractual Clauses)

    -The EU-US Privacy Shield as a data transfer mechanism

    **Only applicable if data is transferred to another country**

    Policies/procedures for the de-identification of personal data if the processing is


    related to the archiving purposes in the public interest, scientific or research
    purposes, or statistical purposes.
    Policy Document / GDPR Requirement
    External Privacy Notice on the website and the "GDPR Compliance Policy" to be created
    from the attached example.

    Information Security Policies and Procedures from the provided templates.


    See Section 4.4.4 - Data Quality
    External Privacy Notice on the website and the "GDPR Compliance Policy" to be created
    A-LIGN working to complete with the data owners.

    This should be defined within the "GDPR Compliane Policy", however more than likely is
    going to be Not Applicable, but this should still be defined.

    Information Security Policies and Procedures from the provided templates.


    This is more than likely going to be Not Applicable, but this should still be defined within
    the "GDPR Compliance Policy"
    See Section 4.4 - Data Use

    See Section 4.4 - Data Use


    See Section 4.1.3 - Data Protection by Design;
    See Data Impact Assessment (DPIA) Guidance in attached document

    See Section 4.4 - Data Use

    See 4.7 Data Suject Requests

    See Section 4.4 - Data Use

    External Privacy Notice on the website

    See 4.4.5 Profiling & Automated Decision-Making

    See 4.12 - Breach Reporting;


    See incident response program within the information security templates attached.
    See 4.7 Data Suject Requests
    See 4.7 Data Suject Requests

    See 4.7 Data Suject Requests

    See 4.7 Data Suject Requests

    See 4.7 Data Suject Requests


    See 4.4.6 Direct Marketing
    Not Applicable

    Not Applicable
    See 4.1.3 Data Protection by Design

    See 4.1.2 Policy Dissimenation and Enforcement

    See Governance within the sample GDPR Policy.

    Information Security Policies and Procedures from the provided templates.

    See Section 4.12 within the sample GDPR Policy and the incident response policy within
    the Information Security Templates.
    Not Applicable

    See Governance within the sample GDPR Policy.

    See Section 4.12 within the sample GDPR Policy and the incident response policy within
    the Information Security Templates.
    See Governance within the sample GDPR Policy.

    See Governance within the sample GDPR Policy.

    Not Applicable

    You might also like