1. What types of personal data does your organization collect, process, or store?

2. Where is personal data stored, and how is it categorized?

3. How is personal data shared internally and externally?

4. Do you maintain a record of processing activities (ROPA)?

11. Who oversees privacy compliance?

12. Are responsibilities clearly defined and communicated?

19. How is data minimization ensured?

20. What is your data retention policy?

26. How is the privacy policy communicated?

27. How do individuals access their data?

32. What security measures protect personal data?

33. How is encryption applied?