Are your organisational procedures checked to ensure 4.8 Article 3.1 that you can preserve the rights of individuals under the NDPR? Is there a clearly available mechanism (e.g. webpage, 4.9 Article 3.1(7) etc.) for data subjects that explains how to contact the organisation to pursue issues relating to personal data? 4.10 Article 2.6 4.11 Article 3.1(5) Are all members of staff trained to recognise and deal with subject access requests? Do you have a procedure for dealing with subject access requests from third parties? Has your organisation implemented appropriate 4.12 Article 4.1(5) procedures to ensure personal data breaches are detected, reported and investigated effectively? Do you have mechanisms in place to notify affected 4.13 Article 4.1(5) individuals where the breach is likely to result in a high risk to their rights and freedoms? Have you trained all members of staff who deal with 4.14 Article 2.6 personal data about their responsibilities and data protection procedures? 4.15 Article 2.6 4.16 Article 2.7 Are these responsibilities written into job descriptions? Have you contracted with any third-party data processors? 4.17 Article 2.7 4.18 Article 2.7 4.19 Article 2.10 If so, are such contracts compliant with the requirements of the NDPR? Have you agreed a schedule to review current contracts for compliance with NDPR? Do you transfer personal data to organisations in countries outside the Nigeria? If so, do you have in place appropriate contracts and 4.20 Article 2.10 4.21 Annexure C 4.22 Article 2.12 methods of ensuring compliance? Are the countries you transfer data to in the White List of Countries with adequate Data Protection laws? Where the countries are not in the White List have you recorded the basis of transfer? 35 | P a g e