Do you have in place adequate information systems security (e.g. as specified in ISO/IEC 27001) and does 4.23 Article 4.1(5)f it include physical, logical, technical and operational measures that ensure the security of processing of personal data? Are members of staff aware that unauthorised 4.24 Article 2.6 access to information is prohibited? Are members of staff aware that any 4.25 Article 2.6 Personal Data acquired in the course of their employment remains confidential even after their exit from the organisation? 36 | P a g e