{"text_format":"3","workbook":"xlsx","n_sheets":1,"sheets":["GDPR SAQ v1.1"],"not_rendered":{"images":5,"macros":1,"defined_names":4,"comments":1},"read":"whole","date_system":"1900"}

{"sheet":"GDPR SAQ v1.1","index":0,"n_rows":395,"n_cols":12,"rows_kept":395,"merged":[[0,0,14,0],[0,1,0,8],[1,1,1,4],[1,5,1,8],[2,1,2,8],[3,1,8,8],[9,5,10,6],[9,7,10,8],[11,1,11,4],[11,5,14,8],[12,1,12,2],[12,3,12,4],[13,1,13,2],[13,3,13,4],[14,1,14,4],[15,1,15,8],[16,1,16,8],[17,0,22,0],[17,1,21,7],[17,8,21,8],[22,1,22,8],[23,0,28,0],[23,1,27,7],[23,8,27,8],[28,1,28,8],[29,0,34,0],[29,1,33,7],[29,8,33,8],[34,1,34,8],[35,0,41,0],[35,1,39,7],[35,8,39,8],[40,1,40,8],[41,1,41,8],[42,0,48,0],[42,1,46,7],[42,8,46,8],[47,1,47,8],[48,1,48,8],[49,0,57,0],[49,1,54,7],[49,8,54,8],[55,1,55,8],[56,1,56,8],[57,1,57,8],[58,0,63,0],[58,1,62,7],[58,8,62,8],[63,1,63,8],[64,0,69,0],[64,1,67,7],[64,8,67,8],[68,1,68,8],[69,1,69,8],[70,0,76,0],[70,1,74,7],[70,8,74,8],[75,1,75,8],[76,1,76,8],[77,0,83,0],[77,1,81,7],[77,8,81,8],[82,1,82,8],[83,1,83,8],[84,0,91,0],[84,1,88,7],[84,8,88,8],[89,1,89,8],[90,1,90,8],[91,1,95,7],[91,8,95,8],[92,0,96,0],[96,1,96,8],[97,0,103,0],[97,1,101,7],[97,8,101,8],[102,1,102,8],[103,1,103,8],[104,0,109,0],[104,1,108,7],[104,8,108,8],[109,1,109,8],[110,0,116,0],[110,1,114,7],[110,8,114,8],[115,1,115,8],[116,1,116,8],[117,0,124,0],[117,1,121,7],[117,8,121,8],[122,1,122,8],[123,1,123,8],[124,1,124,8],[125,0,131,0],[125,1,129,7],[125,8,129,8],[130,1,130,8],[131,1,131,8],[132,0,137,0],[132,1,136,7],[132,8,136,8],[137,1,137,8],[138,0,145,0],[138,1,142,7],[138,8,142,8],[143,1,143,8],[144,1,144,8],[145,1,149,7],[145,8,149,8],[146,0,151,0],[150,1,150,8],[151,1,151,8],[152,0,158,0],[152,1,156,7],[152,8,156,8],[157,1,157,8],[158,1,158,8],[159,0,164,0],[159,1,163,7],[159,8,163,8],[164,1,164,8],[165,0,171,0],[165,1,169,7],[165,8,169,8],[170,1,170,8],[171,1,171,8],[172,0,179,0],[172,1,176,7],[172,8,176,8],[177,1,177,8],[178,1,178,8],[179,1,179,8],[180,0,185,0],[180,1,184,7],[180,8,184,8],[185,1,185,8],[186,0,191,0],[186,1,190,7],[186,8,190,8],[191,1,191,8],[192,0,197,0],[192,1,196,7],[192,8,196,8],[197,1,197,8],[198,0,203,0],[198,1,202,7],[198,8,202,8],[203,1,203,8],[204,0,211,0],[204,1,208,7],[204,8,208,8],[209,1,209,8],[210,1,210,8],[211,1,211,8],[212,0,218,0],[212,1,216,7],[212,8,216,8],[217,1,217,8],[218,1,218,8],[219,0,224,0],[219,1,223,7],[219,8,223,8],[224,1,224,8],[225,0,230,0],[225,1,229,7],[225,8,229,8],[230,1,230,8],[231,0,236,0],[231,1,235,7],[231,8,235,8],[236,1,236,8],[237,0,243,0],[237,1,241,7],[237,8,241,8],[242,1,242,8],[243,1,243,8],[244,0,251,0],[244,1,248,7],[244,8,248,8],[249,1,249,8],[250,1,250,8],[251,1,251,8],[252,0,257,0],[252,1,256,7],[252,8,256,8],[257,1,257,8],[258,0,263,0],[258,1,262,7],[258,8,262,8],[263,1,263,8],[264,0,269,0],[264,1,268,7],[264,8,268,8],[269,1,269,8],[270,0,275,0],[270,1,274,7],[270,8,274,8],[275,1,275,8],[276,0,281,0],[276,1,280,7],[276,8,280,8],[281,1,281,8],[282,0,287,0],[282,1,286,7],[282,8,286,8],[287,1,287,8],[288,0,295,0],[288,1,292,7],[288,8,292,8],[293,1,293,8],[294,1,294,8],[295,1,295,8],[296,0,301,0],[296,1,300,7],[296,8,300,8],[301,1,301,8],[302,0,307,0],[302,1,306,7],[302,8,306,8],[307,1,307,8],[308,0,313,0],[308,1,312,7],[308,8,312,8],[313,1,313,8],[314,0,319,0],[314,1,318,7],[314,8,318,8],[319,1,319,8],[320,0,325,0],[320,1,324,7],[320,8,324,8],[325,1,325,8],[326,0,333,0],[326,1,330,7],[326,8,330,8],[331,1,331,8],[332,1,332,8],[333,1,333,8],[334,0,339,0],[334,1,338,7],[334,8,338,8],[339,1,339,8],[340,0,345,0],[340,1,344,7],[340,8,344,8],[345,1,345,8],[346,0,351,0],[346,1,350,7],[346,8,350,8],[351,1,351,8],[352,0,357,0],[352,1,356,7],[352,8,356,8],[357,1,357,8],[358,0,364,0],[358,1,362,7],[358,8,362,8],[363,1,363,8],[364,1,364,8],[365,0,371,0],[365,1,369,7],[365,8,369,8],[370,1,370,8],[371,1,371,8],[372,0,376,0],[372,1,376,7],[372,8,376,8],[377,1,377,8],[378,0,395,0],[378,1,378,8],[391,1,391,8],[392,1,395,6],[392,7,393,8],[394,7,395,8]]}
[null,"GDPR Self Assessment Questionnaire (SAQ) v1.1"]
{"$rows_empty":10}
[{"$nulls":5},"GDPR SAQ"]
[null,"Assessor Name"]
[null,"Date"]
[]
[null,"Personal Data"]
[null,"Consent based data processing (Articles 7, 8 and 9)"]
["1.1.1","Have you reviewed your organisation’s mechanisms for collecting consent to ensure that it is freely given, specific, informed and that it is a clear indication that an individual has chosen to agree to the processing of their data by way of statement or a clear affirmative action?"]
[]
[]
[]
[]
[null,"Notes:"]
["1.1.2","Have you reviewed your organisation’s mechanisms for collecting consent to ensure that it is freely given, specific, informed and that it is a clear indication that an individual has chosen to agree to the processing of their data by way of statement or a clear affirmative action?"]
[{"$nulls":11},"`"]
[]
[]
[]
[null,"Notes:"]
["1.1.3","Are procedures in place to demonstrate that an individual has consented to their data being processed?"]
[]
[]
[]
[]
[null,"Notes:"]
["1.1.4","Are procedures in place to allow an individual to withdraw their consent to the processing of their personal data?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Children's personal data (Article 8)"]
["1.2.1","Where online services are provided to a child, are procedures in place to verify age and get consent of a parent/ legal guardian, where required?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Legitimate interest based data processing"]
["1.3.1","If legitimate interest is a legal basis on which personal data is processed, has an appropriate analysis been carried out to ensure that the use of this legal basis is appropriate? That analysis must demonstrate that 1) there is a valid legitimate interest, 2) the data processing is strictly necessary in pursuit of the legitimate interest, 3) the processing is not prejudicial to or overridden by the rights of the individual."]
[]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Subject Rights"]
[null,"Access to personal data (Article 15)"]
["2.1.1","Is there a documented policy/procedure for handling Subject Access Requests (SARs)?"]
[]
[]
[]
[]
[null,"Notes:"]
["2.1.2","Is your organisation able to respond to SARs within one month?"]
[]
[]
[]
[null,"Notes:"]
[null,"Data portability (Article 20) "]
["2.2.1","Are procedures in place to provide individuals with their personal data in a structured, commonly used and machine readable format?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Deletion and rectification (Articles 16 and 17)"]
["2.3.1","Are there controls and procedures in place to allow personal data to be deleted or rectified (where applicable)?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Right to restriction of processing (Article 18)"]
["2.4.1","Are there controls and procedures in place to halt the processing of personal data where an individual has on valid grounds sought the restriction of processing?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Right to object to processing (Article 21)"]
[null,"Are individuals told about their right to object to certain types of processing such as direct marketing or where the legal basis of the processing is legitimate interests or necessary for a task carried out in the public interest?"]
["2.5.1"]
[]
[]
[]
[null,"Notes:"]
["2.5.2","Are there controls and procedures in place to halt the processing of personal data where an individual has objected to the processing?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Profiling and automated processing (Article 22)"]
["2.6.1","If automated decision making, which has a legal or significant similar affect for an individual, is based on consent, has explicit consent been collected?"]
[]
[]
[]
[]
[null,"Notes:"]
["2.6.2","Where an automated decision is made which is necessary for entering into, or performance of, a contract, or based on the explicit consent of an individual, are procedures in place to facilitate an individual’s right to obtain human intervention and to contest the decision?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Restrictions to data subject rights (Article 23)"]
["2.7.1","Have the circumstances been documented in which an individual’s data protection rights may be lawfully restricted? Note: the Irish Data Protection Bill will set out further details on the implementation of Article 23."]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Accuracy and Retention"]
[null,"Purpose limitation"]
["3.1.1","Is personal data only used for the purposes for which it was originally collected?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Minimisation"]
["3.2.1","Is the personal data collected limited to what is necessary for the purposes for which it is processed?"]
[]
[]
[]
[]
[null,"Notes:"]
["3.2.2","Is the personal data collected limited to what is necessary for the purposes for which it is processed?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Accuracy"]
[null,"Are procedures in place to ensure personal data is kept up to date and accurate and where a correction is required, the necessary changes are made without delay?"]
["3.3.1"]
[]
[]
[]
[null,"Notes:"]
[null,"Retention"]
["3.4.1","Are retention policies and procedures in place to ensure data is held for no longer than is necessary for the purposes for which it was collected?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Other legal obligations governing retention"]
["3.5.1","Is your business subject to other rules that require a minimum retention period (e.g. medical records/tax records)?"]
[]
[]
[]
[]
[null,"Notes:"]
["3.5.2","Do you have procedures in place to ensure data is destroyed securely, in accordance with your retention policies?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Duplication of records"]
["3.6.1","Are procedures in place to ensure that there is no unnecessary or unregulated duplication of records?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Transparency Requirements"]
[null,"Transparency to customers and employees (Articles 12, 13 and 14)"]
["4.1.1","Are service users/employees fully informed of how you use their data in a concise, transparent, intelligible and easily accessible form using clear and plain language?"]
[]
[]
[]
[]
[null,"Notes:"]
["4.1.2","Where personal data is collected directly from the individuals, are procedures in place to provide the information listed at Article 13 of the GDPR?"]
[]
[]
[]
[]
[null,"Notes:"]
["4.1.3","If personal data is not collected from the subject but from a third party (e.g. acquired as part of a merger) are procedures in place to provide the information listed at Article 14 of the GDPR?"]
[]
[]
[]
[]
[null,"Notes:"]
["4.1.4","When engaging with individuals, such as when providing a service, sale of a good or CCTV monitoring, are procedures in place to proactively inform individuals of their GDPR rights?"]
[]
[]
[]
[]
[null,"Notes:"]
["4.1.5","Is information on how the organisation facilitates individuals exercising their GDPR rights published in an easily accessible and readable format?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Other Data Controller Requirements"]
[null,"Supplier Agreements (Articles 27 to 29)"]
["5.1.1","Have agreements with suppliers and other third parties processing personal data on your behalf been reviewed to ensure all appropriate data protection requirements are included?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Protection Officers (DPOs) (Articles 37 to 39"]
["5.2.1","Do you need to appoint a DPO as per Article 37 of the GDPR?"]
[]
[]
[]
[]
[null,"Notes:"]
["5.2.2","If it is decided that a DPO is not required, have you documented the reasons why?"]
[]
[]
[]
[]
[null,"Notes:"]
["5.2.3","Where a DPO is appointed, are escalation and reporting lines in place? Are these procedures documented?"]
[]
[]
[]
[]
[null,"Notes:"]
["5.2.4","Have you published the contact details of your DPO to facilitate your customers/ employees in making contact with them? (Note: post 25 May 2018 you will also be required to notify your data protection authority of your DPO’s contact details)"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Protection Impact Assessments (DPIAs) (Article 35)"]
["5.3.1","If your data processing is considered high risk, do you have a process for identifying the need for, and conducting of, DPIAs? Are these procedures documented?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Security"]
[null,"Appropriate technical and organisational security measures"]
["6.1.1","Have you assessed the risks involved in processing personal data and put measures in place to mitigate against them?"]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.2","Is there a documented security programme that specifies the technical, administrative and physical safeguards for personal data?"]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.3","Is there a documented process for resolving security related complaints and issues?"]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.4","Is there a designated individual who is responsible for preventing and investigating security breaches?"]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.5","Are industry standard encryption technologies employed for transferring, storing, and receiving individuals' sensitive personal information?"]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.6","Is personal information systematically destroyed, erased, or anonymised when it is no longer legally required to be retained."]
[]
[]
[]
[]
[null,"Notes:"]
["6.1.7","Can access to personal data be restored in a timely manner in the event of a physical or technical incident?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Data Breaches"]
[null,"Data Breach response obligations (Article 33 and 34)"]
["7.1.1","Does the organisation have a documented privacy and security incident response plan?"]
[]
[]
[]
[]
[null,"Notes:"]
["7.1.2","Are plans and procedures regularly reviewed?"]
[]
[]
[]
[]
[null,"Notes:"]
["7.1.3","Are there procedures in place to notify the office of the Data Protection Commissioner of a data breach?"]
[]
[]
[]
[]
[null,"Notes:"]
["7.1.4","Are there procedures in place to notify data subjects of a data breach (where applicable)?"]
[]
[]
[]
[]
[null,"Notes:"]
["7.1.5","Are all data breaches fully documented?"]
[]
[]
[]
[]
[null,"Notes:"]
["7.1.6","Are there cooperation procedures in place between data controllers, suppliers and other partners to deal with data breaches?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"International Data Transfers (Outside EEA) - if applicable"]
[null,"International data transfers (Articles 44 to 50)"]
["8.1.1","Is personal data transferred outside the EEA, e.g. to the US or other countries?"]
[]
[]
[]
[]
[null,"Notes:"]
["8.1.2","Does this include any special categories of personal data?"]
[]
[]
[]
[]
[null,"Notes:"]
["8.1.3","What is the purpose(s) of the transfer?"]
[]
[]
[]
[]
[null,"Notes:"]
["8.1.4","Who is the transfer to?"]
[]
[]
[]
[]
[null,"Notes:"]
["8.1.5","Are all transfers listed - including answers to the previous questions (e.g. the nature of the data, the purpose of the processing, from which country the data is exported and which country receives the data and who the recipient of the transfer is?)"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Legality of international transfers"]
["8.2.1","Is there a legal basis for the transfer, e.g. EU Commission adequacy decision; standard contractual clauses. Are these bases documented?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"Transparency"]
["8.3.1","Are data subjects fully informed about any intended international transfers of their personal data?"]
[]
[]
[]
[]
[null,"Notes:"]
[null,"CATEGORIES"]
[null,{"$f":"B16","v":"Personal Data"},{"$f":"B57","v":"Data Subject Rights"},{"$f":"B124","v":"Accuracy and Retention"},{"$f":"B179","v":"Transparency Requirements"},{"$f":"B211","v":"Other Data Controller Requirements"},{"$f":"B251","v":"Data Security"},{"$f":"B295","v":"Data Breaches"},{"$f":"B333","v":"International Data Transfers (Outside EEA) - if applicable"}]
[null,{"$f":"SUM(SUMIF(B382:B387,\"1\") / 6)*100","v":0},{"$f":"SUM(SUMIF(C382:C391,\"1\") / 10)*100","v":0},{"$f":"SUM(SUMIF(D382:D389,\"1\") / 8)*100","v":0},{"$f":"SUM(SUMIF(E382:E387,\"1\") / 5)*100","v":0},{"$f":"SUM(SUMIF(F382:F387,\"1\") / 6)*100","v":0},{"$f":"SUM(SUMIF(G382:G388,\"1\") / 7)*100","v":0},{"$f":"SUM(SUMIF(H382:H387,\"1\") / 6)*100","v":0},{"$f":"SUM(SUMIF(I382:I388,\"1\") / 7)*100","v":0}]
[null,0,0,0,0,0,0,0,0]
[null,0,0,0,0,0,0,0,0]
[null,0,0,0,0,0,0,0,0]
[null,0,0,0,0,0,0,0,0]
[null,0,0,0,0,0,0,0,0]
[null,0,0,0,2,0,0,0,0]
[null,null,0,0,null,null,0,null,0]
[null,null,0,0]
[null,null,0]
[null,null,0]
[]
[{"$nulls":7},"Overall Compliance Score"]
[]
[{"$nulls":7},{"$f":"SUM((B381:I381)/8)/100","v":{"v":0,"d":"0%"}}]