Does your business collect only the personal data it needs? 1. Does your business collect only the personal data it needs?
We collect whatever we can, just in case. We try to, but forms and processes have never been reviewed. We have reviewed our forms and collect only what each purpose needs.
Do staff know which information is confidential or restricted? 2. Do staff know which information is confidential or restricted?
There is no shared understanding. People have a rough idea, but nothing is written down. We use simple classification labels and staff know how to handle each.
How is access to sensitive data like ID copies and bank details controlled? 3. How is access to sensitive data like ID copies and bank details controlled?
Anyone in the office can open them. They are in one folder, but access is not reviewed. Only named people can access them, and access is reviewed when roles change.
Do you delete old data on a schedule? 4. Do you delete old data on a schedule?
We never delete anything. We delete occasionally, without a rule. We have retention periods and review old data on a set schedule.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered