Getting to know you

Thank you for considering eNaycH to assist you in your data protection & privacy compliance. In order to get to know you and your organisation better and to understand what assistance you may need, could you kindly complete the following.

It should take approximately 10 minutes to complete.

Questionnaire - Step 1 of 9

Legal Entity Status

Are you a:

Company Number

Contact Name *

Contact Email *

Phone

Website / URL

Address

Address Line 1

Address Line 2

City

State / Province / Region

Postal Code

Country

Is this address *

Trading Address

Address Line 1

Address Line 2

City

State / Province / Region

Postal Code

Country

Have you appointed a Data Protection Officer?

DPO Contact details if different to Contact above

Data Protection (Charges and Information) Regulations 2018

DPCIR: Which of the following applies to you?

Do you have a maximum turnover of £632,000 for your financial year or no more than 10 members of staff?
Do you have a maximum turnover of £36 million for your financial year or no more than 250 members of staff?

DPCIR: How many FTE members of staff do you have, (if applicable)?

Remember the definition of members of staff and include apprentices, volunteers (paid or unpaid) if they are acting under your instructions.

DPCIR Registration: Which of the following applies?

Not registering, if required to do so and not relying on an exemption, could land you with a fine!

DPCIR Exemptions: Do you process personal data for the following reasons as part of your own operation?

Staff Administration
Advertising, Marketing and Public Relations
Accounts and Records
Not-for-Profit purposes
Personal, Family or Household affairs
Maintaining a Public Register
Processing personal information without an automated system such as a computer

Documentation | Art 30 and DPA2018 exemptions

Documentation Exemptions: If you have fewer than 250 employees, do you only process personal data that:

Are not occasional
Could result in a risk to the rights and freedoms of individuals
Involves the processing of special category personal or criminal conviction and offence data.
Not Applicable

Documentation Exemptions: Do you operate a CCTV system?

Documentation Exemptions: Do you process personal data on behalf of another Data Controller? *

If you are a data processor you should document the processing, using the simple Data Processor template from the ICO.

DPA2018: Are you aware of the Data Protection Act 2018?

DPA2018: Do you rely on any of the provisions in the Act?

If employing members of staff you will need to include this as part of your Controller documentation.

DPA2018: Are you aware of Chapter 12, Part 5, Section 170 (Criminal Offences)

Ensure this section is included as part of your internal training for members of staff to protect your business

CMA: Are you aware of the Computer Misuse Act 1990?

This is important legislation and applies to all data, not just that governed by the Data Protection legislation and should be included in any training.

Privacy and Electronic Communications Regulations (PECR)

PECR: Do you conduct Direct Marketing?

PECR: Which channels do you use?
Telephone
Email
Text/SMS
Faxes
None of the above
Direct Marketing to 'individual subscribers' requires consent under PECR and the data protection legislation.

PECR: Which of these services to you screen telephone numbers against before calling?

PECR: Do you use bought in email or other lists?
Consent has to be demonstrated using bought in lists, ensure this is given by the supplier and that the information is up to data.

PECR: Do you have a website?
Consideration under PECR has to be given in relation to placing cookies and other similar technolgy

PECR: Are you aware of the requirements when -
Placing Cookies and similar tracking technologies on the website
Keeping communications service secure
Individuals privacy in regards to traffic and location data, itemised billing, line identification and directory listings?
Cookies in particular need to be grouped first by necessary for the functionality of the website, then for the non-necessary classified by function/purpose and be set to OFF by default.

WEB: Hosting your website. Is your site
Knowing how your website is being hosted can help lessen the complexity when it comes to compliance, documentation and to be honest "hassle"

WEB: Hosting, do you have a written Data Processing Agreement in place?

WEB: Content Management Systems, which do you use?

WEB: Operating System, who is responsible for updating the server 'services' (Apache, PHP etc)

WEB: Does the hosting provider offer support to you?

WEB: Who is responsible for keeping the CMS updated and secured?
Keeping the CMS Core, Plugins, Themes etc is important as part of the technical and organisational measures under the legislation.

General Data Protection Regulations (GDPR)

GDPR: Data Protection Policy do you have one? (for internal use)
You can find them here: https://enaych.com/gdpr-menu/

GDPR: Do you know the definitions and principles of the GDPR?
You can find them here: https://enaych.com/gdpr-menu/ Articles 4 & 5

GDPR: Purposes of Processing, have you defined them?
You can find them here: https://enaych.com/gdpr-menu/

GDPR: Legitimate Interests, have you assessed them?
You can find them here: https://enaych.com/gdpr-menu/

GDPR: Recipients or Categories of Recipients, have you defined them?

GDPR Art 6. Processing General Personal Data, which lawful bases are you relying on?
a) Consent
b) Contract
c) Legal Obligation
d) Vital Interests
e) Public Interest
f) Legitimate Interests
Lawful bases of processing can be found here: https://enaych.com/gdpr-menu/ Article 6

GDPR Art 9(2). Processing Special Category Personal Data, which lawful bases are you relying on?
a) Explicit consent to the processing of those personal data for one or more specified purposes ...
b) Employment and social security and social protection law ..
c) Vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
d) Legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim ...
e) Processing relates to personal data which are manifestly made public by the data subject.
f) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
g) Processing is necessary for reasons of substantial public interest ...
h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services ...
i) Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices etc
j) Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) ...
Not applicable
Lawful bases of processing can be found here: https://enaych.com/trainingsite/gdpr-menu/

GDPR: Art 10, Are you aware of processing of personal data relating to criminal convictions and offences

GDPR: Art 11, Are you aware of processing which does not require identification

GDPR: Art 12, Are you aware of all the Data Subjects Rights?

GDPR: How many rights to Data Subjects have?

GDPR: Do you have the systems and processes in place to handle Data Subject Access Requests, include verbal ones?

GDPR: Data Retention, have you defined and documented your data retention period for all processing?

GDPR: Have you identified all third party Data Processors

GDPR: Are all processors in the EEA? Have you ensured you have complied with the requirements for International Data Transfers under Articles 44-47?

GDPR: Are there written agreements in place?

GDPR: Do you process personal data as part of any statutory requirement of as part of any contractual agreement?

GDPR: Do you using profiling or automatic decision making processes in respect of personal data processing activities?

GDPR: Privacy Policy/Notice - Have you published one to inform individuals about the processing of their personal data?

GDPR: Do you process third party personal data from
Social Media
Public Sources
Logs and/or Analytics
Recruitment Agencies

GDPR: Which of the following are you aware of and/or implementing
Data Privacy Impact Assessments
Privacy by Design and Default
Security of Processing

GDPR: Data Breach Reporting. Are you aware of the requirements and have systems, processes and technical assistance on hand to deal with them?
Have you considered national holidays, office/factory shut-down's and how you would cope in those situations?

Message

Getting to know you

Links

Certifications

We’re Green

Awards