Free tool · No signup
Ten yes/no questions. Two minutes. Get an honest score on your policy posture and three concrete next steps. We don't store your answers.
Do you have a written, signed-off Data Protection Policy?
A top-level policy approved by an owner or director, reviewed in the last 12 months.
Do you maintain a Record of Processing Activities (RoPA)?
Article 30 register listing your processing purposes, lawful bases and data categories.
Could you respond to a Subject Access Request inside 30 days?
A documented procedure, an inbox to route them to, and someone trained to handle them.
Do you have a documented incident response plan with a 24/7 contact?
Includes severity classification and who to call out of hours.
Have you tested your breach notification path in the last 12 months?
A tabletop exercise or live drill that practised the 72-hour ICO notification path.
Do you have an information classification standard staff actually use?
e.g. Public / Internal / Confidential / Restricted with handling rules per tier.
Do you have a written Access Control Policy with MFA on privileged accounts?
Do you have a current Retention Schedule covering all major record types?
HR, payroll, customer records, marketing, IT logs, contracts.
Do suppliers handling your data sign a written data-processing or security agreement?
Do you have a named Data Protection Lead or DPO?
A specific person, not just "the owner deals with it".
If you handle personal data of people in Japan, do you have an APPI-compliant privacy policy and a PPC leak-reporting procedure?
Answer Yes if you don't handle Japanese personal data. APPI requires published purposes of use and reports to the PPC within 3–5 days for serious leaks.
If you employ staff in Japan, do you have My Number handling rules and a published external-transmission (cookie) notice?
Answer Yes if this doesn't apply. Covers the My Number Act and the Telecommunications Business Act's 2023 cookie/tag notice rule.
0 of 12 answered
Policly