Data protection operations

What this assessment covers

The 12 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

• Is each sensitive-data use connected to a defined purpose and owner?
• Are high-impact automated decisions reviewed for people and context?
• Are new uses or disclosures reviewed before launch?

• Can the organization trace important personal data across systems and suppliers?
• Are retention rules implemented rather than only documented?
• Are test and analytics datasets governed like their source data?

• Can a verified request reach all relevant systems?
• Are correction and deletion decisions consistently recorded?
• Can people understand the important use without reading internal architecture?

• Can an incident team determine whose data may be affected?
• Are notification decisions evidence-linked and reviewed?
• Do exercises include customer, employee and supplier data scenarios?