Does your DPIA Policy address issues such as: a) A description of the envisaged processing operations b) The purposes of the processing c) The legitimate interest pursued by the controller 1.19 Article 4.1(5) d) An assessment of the necessity and proportionality of the processing operations in relation to the purposes e) An assessment of the risks to the rights and freedoms of Data Subject f) Risk mitigation measures being proposed to address the risk 2 DATA PROTECTION OFFICER/DATA PROTECTION COMPLIANCE ORGANISATION Article 4.1(4) Have you appointed a Data Protection Compliance Organisation (DPCO)? Which kind of service has a DPCO provided for you till Article 4.1(4) date? Hint- Audit, Data Protection Impact Assessment, Data Breach Remediation etc. Article 4.1(2) Does your DPCO also perform the role of your DPO? Has a Data Protection Officer (DPO) been appointed 2.1 Article 4.1(2) and given responsibility for NDPR compliance and the management of organisational procedures in line with the requirements of NDPR? Article 4.1(4) Do you utilise the same DPCO for Data Protection compliance implementation and audit? 2.2 Article 4.1(3) Have you trained your Data Protection Officer in the last one year? Article 4.1(2) Article 4.1(2) Does the Data Protection Officer (DPO) have sufficient access, support and the budget to perform the role? If the DPO has other job functions, have you evaluated whether there is no conflict of interest? Does the DPO have verifiable professional expertise and knowledge of data protection to do the following: a) To inform and advice the business, management, Article 4.1(2) employees and third parties who carry out processing, of their obligations under the NDPR b) To monitor compliance with the NDPR and with the organisation's own data protection objectives 32 | P a g e