Manager's Data Protection Audit

• Site conducted

  Select

• Conducted on

  Date

• Prepared by

• Location
  Address

Staff

• Question two or three staff on their obligations relating to data security. Were they able to answer confidently and correctly?

  Yes

  No

  N/A

• Ask the same staff if they know where to access the company's data protection policies. Did they answer correctly?

  Yes

  No

  N/A

• Ask the same staff to explain how they would report a suspected data breach. Did they answer correctly?

  Yes

  No

  N/A

• Have all staff completed GDPR training within the last three years?

  Yes

  No

  N/A

• Have any staff been subject to disciplinary action in relation to data protection and security within the last six months? If so, provide details.

  No

  Yes

• Have all staff signed an Employee Privacy Notice, which is stored on their personnel file?

  No

  Yes

Hard Copy Documentation and Physical Access

• Are all offices, files and cabinets containing personal data locked when not in use?

  Yes

  No

  N/A

• Has any confidential waste been disposed of in the last six months and, if so, is there a destruction certificate? (Use 'N/A' if not destruction has taken place)

  Yes

  No

  N/A

• Has anybody inappropriately accessed or attempted to access confidential records in the last six months? If so, provide details.

  No

  Yes

Digital Access to Records

• Is the allocation of administrator rights to electronic platforms (Coolcare, PCS, etc) restricted to only those who need it?

  Yes

  No

  N/A

• Have all staff who have left employment within the last six months had their access right removed quickly?

  Yes

  No

  N/A

• Do all staff use only their own login information when accessing personal data? For example, staff sharing a PCS account would not be appropriate.

  Yes

  No

  N/A

• Spot check the computers in the building. Are all screen locked when not in use?

  Yes

  No

  N/A

• Has anybody inappropriately accessed or attempted to access confidential digital records in the last six months? If so, provide details.

  No

  Yes

• Have appropriate security measures been applied to all computers and mobile devices? I.e. are all appropriately password protected?

  Yes

  No

  N/A

• In the last six months, have you seen any evidence of staff using company computers inappropriately, such as for downloading unapproved software, social media, etc?

  No

  Yes

Sharing Data / Legal Requirements

• Is company policy for sharing personal information via post being followed?

  Yes

  No

  N/A

• Is company policy for sharing information via email being followed?

  Yes

  No

  N/A

• Do you know how to access the company's Information Access Register? If not, speak with the Compliance Director.

  Yes

  No

  N/A

• Have all residents and their next of kin been issued with a GDPR Fair Processing Notice?

  Yes

  No

  N/A