HR-GDPR Audit 1 - duplicate

• Audit carried out:

  Date

• Name:

• Company Background

• Contact details: Email:

• Company Address:

HR Management

• Are the HR goals aligned with the organization?

  Yes

  No

  Unsure

  N/A

• Structure People Structure, Organisational Charts, Roles and Responsibilities known

  Yes

  No

  Unsure

  N/A

• Salary, grading, opportunities communicated for promotion

  Yes

  No

  Unsure

  N/A

Recruitment

• Does each position within the organization have a job description?

  Yes

  No

  Unsure

  N/A

• Are the job descriptions up to date?

  Yes

  No

  Unsure

  N/A

• Are job openings offered to current employees?

  Yes

  No

  Unsure

  N/A

• Is the employee turnover rate monitored?

  Yes

  No

  Unsure

  N/A

Onboarding

• Do new employees receive a contract and employee handbook?

  Yes

  No

  Unsure

  N/A

• Are the correct onboarding documents being issued?

  Yes

  No

  Unsure

  N/A

• Do new employees receive the right induction training?

  Yes

  No

  Unsure

  N/A

• Do new employees have follow up meetings/probation reviews?

  Yes

  No

  Unsure

  N/A

Employee Relations

• Are Performance Appraisals in place?

  Yes

  No

  Unsure

  N/A

• Are your practices in line with your policies?

  Yes

  No

  Unsure

  N/A

• Are you in line with ROI legislation?

  Yes

  No

  Unsure

  N/A

• Is there a clear and well communicated process in place for receiving and handling employee complaints/issues?

  Yes

  No

  Unsure

  N/A

Training and Development

• Are employees provided with training?

  Yes

  No

  Unsure

  N/A

• Are employees provided with opportunities to further develop their skills?

  Yes

  No

  Unsure

  N/A

• Is the provided training and opportunities within budget?

  Yes

  No

  Unsure

  N/A

• Do employees receive ongoing feedback?

  Yes

  No

  Unsure

  N/A

Documentation

• Do all employees have a personnel file? Are they manual or on HRIS?

  Yes

  No

  Unsure

  N/A

• Are personnel files up to date?

  Yes

  No

  Unsure

  N/A

• Are documents kept for the required duration?

  Yes

  No

  Unsure

  N/A

• Does the organization comply with the ROI GDPR Laws?

  Yes

  No

  Unsure

  N/A

Compensation & Benefits

• Commission Schemes for each area/Dept

  Yes

  No

  Unsure

  N/A

• Bonus Schemes

  Yes

  No

  Unsure

  N/A

• Annual Salary Review

  Yes

  No

  Unsure

  N/A

Comms & Engagement

• Weekly meetings and management meetings in general

  Yes

  No

  Unsure

  N/A

• Are there regular meetings held across the teams?

  Yes

  No

  Unsure

  N/A

• Is there an open form of communication between HR and other departments?

  Yes

  No

  Unsure

  N/A

• Company Values Are they utilised and understood across the business. Are people living and breathing the values?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Does the organisation have a GDPR programme in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation carry out profiling?

  Yes

  No

  Unsure

  N/A

• Do you process data on a large scale?

  Yes

  No

  Unsure

  N/A

• Do you process high risk data e.g. special category data, children’s data, criminal offence data, payment data, data that the organisation considers should be particularly protected

  Yes

  No

  Unsure

  N/A

• Does the company carry out transfers of large scale or high risk data to third parties?

  Yes

  No

  Unsure

  N/A
TO PUT IN TITLE

• Does the organisation process data on the basis of consent?

  Yes

  No

  Unsure

  N/A

• Does you use intake/new client/ onboarding forms either online or in person?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a high staff turnover or take on seasonal staff?

  Yes

  No

  Unsure

  N/A

• Does the organisation hold data collected more than 7 years ago?

  Yes

  No

  Unsure

  N/A

• How often does the organisation carry out GDPR training?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Do you carry out processes for which the Data Commissioner's Office (DCO) states that a Data Protection Impact Assessment (DPIA) is mandatory?

  Yes

  No

  Unsure

  N/A

• Does the organisation report regularly receiving data subject rights requests?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a DSAR procedure in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a third-party register in place?

  Yes

  No

  Unsure

  N/A

• Is the organisation’s WiFi network visible in public or third party spaces?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Does the organisation work online, hybrid, open to the public or closed office?

  Yes

  No

  Unsure

  N/A

• Does the organisation outsource significant IT functions?

  Yes

  No

  Unsure

  N/A

• Does the organisation outsource any services to contractors?

  Yes

  No

  Unsure

  N/A

• Does the organisation have any Data Processing Agreements in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation transfer any data outside the EU/EEA?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Does the organisation have any Standard Contractural Clauses in place?

  Yes

  No

  Unsure

  N/A

• Would an interruption to the organisation’s core personal data processing functions significantly negatively affect individuals?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a a Data Breach procedure in place?

  Yes

  No

  Unsure

  N/A

• Does the organisaton have a Register of Processing Activities in place?

  Yes

  No

  Unsure

  N/A

• Is the organisation required to have a Data Protection Officer in place?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Who is responsible for GDPR within the organisation?

  Yes

  No

  Unsure

  N/A

• Does the DPO or person in charge of GDPR have direct access to management?

  Yes

  No

  Unsure

  N/A

• Does the organisation have any segregation of duties procdures in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a business continuity plan in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a website and when were the polices reviewed last?

  Yes

  No

  Unsure

  N/A

TO PUT IN TITLE

• Does the organisation have a social media presence and is there an apppointed person for this role?

  Yes

  No

  Unsure

  N/A

• Does the organisation have any CCTV in place?

  Yes

  No

  Unsure

  N/A

• Does the organisation have a data deletion policy in place?

  Yes

  No

  Unsure

  N/A