perform? Have you identified lawful basis for your processing Article 2.2 Article 2.5 4.2 Article 2.5 activities and documented this? Have you explained the lawful basis for processing personal data in your privacy notice(s)? Have you reviewed how you seek, record and manage consent? Have you reviewed the systems currently used to Article 4.1 record consent and have you implemented appropriate mechanisms to ensure an effective audit trail? If your organisation offers services directly to children, 4.3 Article 2.4 have you communicated privacy information in a clear, plain way that a child will understand? Do you adopt data pseudonymisation, anonymisation Article 2.6 and encryption methods to reduce exposure of personal data? Have you identified all the points at which personal data is collected: websites, application forms 4.4 Article 1.3(xix) (employment and other), emails, in-bound and outbound telephone calls, CCTV, exchanges of business cards and, attendance at events etc? 4.5 Article 3.1 (8) Article 3.1(8) Do you have procedures for regularly reviewing the accuracy of personal data? Do you have a system for Data Subjects to erase or amend their personal data in your custody? Have you identified all the ways in which personal data 4.6 Article 2.5(d) is stored, including backups? Have you evaluated points where data minimisation Article 2.1.1(a) can be implemented in your data collection process? Have you reviewed your forms and other data collection tools to comply with the NDPR? Have you identified the purposes for processing 4.7 Article 2.2 personal data, for determining and authorising internal or external access and all disclosures of data? 34 | P a g e