{"text_format":"1","workbook":"xlsx","n_sheets":15,"sheets":["Introduction","Dashboard","Master sheet","Tables & Graphs","Lookup","1. Leadership and oversight","2. Policies and procedures","3. Training and awareness","4. Information rights","5. Transparency","6 ROPA and lawful basis","7. Contracts and data sharing","8. Risks and DPIAs","9. Records management and sec..","10. Breach response and monitor"],"not_rendered":{"charts":12,"images":1,"macros":1,"external_links":0,"defined_names":11,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"Accountability Toolkit Tracker"]
[null,"\nYou can use this Tracker to record and track your progress. We have split the Tracker into tabs across the bottom where you can record your progress.\n\nThe first tab is called ‘Dashboard’. The dashboard will update automatically when you fill in the spreadsheet.\n\nThe next tab is called ‘Master Sheet’. This shows the Accountability toolkit and records all your responses in one place.\n\nThe other tabs show each category of the toolkit.\n\nWe have suggested some columns to help you to build your own action plan and improve your accountability. You can add new columns at the end of the existing columns and the ‘Master Sheet’ will update automatically. However, as the spreadsheet contains formula we would not recommend altering any of the existing columns.\n\nKey phrases:\n\nCurrent status – This refers to whether you are ‘fully meeting our expectation’, ‘partially meeting our expectation’, or ‘not meeting our expectation’. You can also record the status as ‘not applicable’ to your organisation.  You can choose the status from a drop-down list.\n\nReasons for status – You can record the reasons why you have chosen the ‘Current status’ for this expectation.\n\nActions – You can describe what you need to do next to meet the expectation.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\nThe Data protection audit framework, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Dashboard","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Master sheet","index":2,"n_rows":340,"n_cols":16,"rows_kept":340,"cut":false,"hidden":false,"merged":[[0,0,0,3],[2,2,8,2],[2,0,34,0],[81,2,84,2],[73,2,75,2],[152,2,153,2],[9,2,13,2],[52,2,58,2],[63,2,66,2],[67,2,70,2],[71,2,72,2],[52,0,72,0],[59,2,62,2],[141,1,145,1],[146,1,148,1],[149,1,151,1],[152,1,153,1],[14,2,19,2],[24,2,30,2],[20,2,23,2],[31,2,34,2],[44,2,47,2],[39,2,43,2],[35,0,51,0],[35,2,38,2],[129,2,132,2],[123,2,124,2],[48,2,51,2],[167,2,169,2],[115,0,145,0],[146,0,178,0],[174,2,178,2],[155,1,160,1],[161,1,163,1],[164,1,166,1],[167,1,169,1],[170,1,173,1],[174,1,178,1],[164,2,166,2],[161,2,163,2],[149,2,151,2],[97,2,101,2],[105,2,106,2],[112,2,114,2],[133,2,135,2],[115,2,122,2],[76,2,80,2],[73,1,75,1],[219,2,225,2],[216,2,218,2],[298,2,301,2],[254,2,258,2],[247,2,249,2],[243,2,246,2],[321,2,325,2],[93,2,96,2],[102,2,104,2],[208,2,209,2],[302,2,308,2],[309,2,312,2],[313,2,316,2],[317,2,320,2],[136,2,140,2],[141,2,145,2],[107,2,111,2],[125,2,128,2],[239,2,242,2],[146,2,148,2],[326,2,332,2],[333,2,336,2],[337,2,339,2],[191,2,197,2],[202,2,204,2],[205,2,206,2],[85,2,88,2],[89,2,92,2],[233,2,238,2],[226,2,232,2],[170,2,173,2],[155,2,160,2],[290,2,297,2],[270,2,283,2],[259,2,261,2],[262,2,264,2],[198,2,201,2],[179,2,182,2],[183,2,188,2],[189,2,190,2],[265,2,269,2],[284,2,289,2],[250,2,253,2],[210,2,215,2],[317,1,320,1],[321,1,325,1],[326,1,332,1],[333,1,336,1],[337,1,339,1],[302,1,308,1],[2,1,8,1],[9,1,13,1],[14,1,19,1],[20,1,23,1],[24,1,30,1],[31,1,34,1],[35,1,38,1],[39,1,43,1],[44,1,47,1],[48,1,51,1],[52,1,58,1],[59,1,62,1],[63,1,66,1],[67,1,70,1],[71,1,72,1],[81,1,84,1],[85,1,88,1],[89,1,92,1],[313,1,316,1],[93,1,96,1],[97,1,101,1],[102,1,104,1],[239,0,301,0],[210,0,238,0],[179,0,209,0],[179,1,182,1],[183,1,188,1],[189,1,190,1],[191,1,197,1],[198,1,201,1],[202,1,204,1],[205,1,206,1],[105,1,106,1],[107,1,111,1],[123,1,124,1],[125,1,128,1],[129,1,132,1],[133,1,135,1],[136,1,140,1],[76,1,80,1],[270,1,283,1],[284,1,289,1],[290,1,297,1],[298,1,301,1],[302,0,339,0],[208,1,209,1],[210,1,215,1],[216,1,218,1],[219,1,225,1],[226,1,232,1],[233,1,238,1],[239,1,242,1],[243,1,246,1],[247,1,249,1],[250,1,253,1],[254,1,258,1],[259,1,261,1],[262,1,264,1],[265,1,269,1],[73,0,114,0],[112,1,114,1],[115,1,122,1],[309,1,312,1]]}
["Accountability Tracker\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)",{"$f":"IF(ISBLANK('1. Leadership and oversight'!K1),\"\",'1. Leadership and oversight'!K1)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!L1),\"\",'1. Leadership and oversight'!L1)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!M1),\"\",'1. Leadership and oversight'!M1)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!N1),\"\",'1. Leadership and oversight'!N1)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!O1),\"\",'1. Leadership and oversight'!O1)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.1","Assign overall responsibility for data protection and information governance to the board, or highest senior management level.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E2),\"\",'1. Leadership and oversight'!E2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F2),\"\",'1. Leadership and oversight'!F2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G2),\"\",'1. Leadership and oversight'!G2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H2),\"\",'1. Leadership and oversight'!H2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I2),\"\",'1. Leadership and oversight'!I2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J2),\"\",'1. Leadership and oversight'!J2)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K2),\"\",'1. Leadership and oversight'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O2),\"\",'1. Leadership and oversight'!O2)","v":""}]
[{"$f":"A3","v":"Leadership and Oversight"},{"$f":"B3","v":1.1000000000000001},"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.2","Promote a proactive, positive culture of data protection compliance and ensure decision-makers lead by example.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E3),\"\",'1. Leadership and oversight'!E3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F3),\"\",'1. Leadership and oversight'!F3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G3),\"\",'1. Leadership and oversight'!G3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H3),\"\",'1. Leadership and oversight'!H3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I3),\"\",'1. Leadership and oversight'!I3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J3),\"\",'1. Leadership and oversight'!J3)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K3),\"\",'1. Leadership and oversight'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O3),\"\",'1. Leadership and oversight'!O3)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.3","Establish clear reporting lines and information flows between relevant groups; such as from a management board to an audit committee, or from an executive team to an information governance steering group.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E4),\"\",'1. Leadership and oversight'!E4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F4),\"\",'1. Leadership and oversight'!F4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G4),\"\",'1. Leadership and oversight'!G4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H4),\"\",'1. Leadership and oversight'!H4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I4),\"\",'1. Leadership and oversight'!I4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J4),\"\",'1. Leadership and oversight'!J4)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K4),\"\",'1. Leadership and oversight'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O4),\"\",'1. Leadership and oversight'!O4)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.4","Clearly set out in policies the organisational structure for managing data protection and information governance.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E5),\"\",'1. Leadership and oversight'!E5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F5),\"\",'1. Leadership and oversight'!F5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G5),\"\",'1. Leadership and oversight'!G5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H5),\"\",'1. Leadership and oversight'!H5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I5),\"\",'1. Leadership and oversight'!I5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J5),\"\",'1. Leadership and oversight'!J5)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K5),\"\",'1. Leadership and oversight'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O5),\"\",'1. Leadership and oversight'!O5)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.5","Set out responsibilities and reporting lines to management in job descriptions.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E6),\"\",'1. Leadership and oversight'!E6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F6),\"\",'1. Leadership and oversight'!F6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G6),\"\",'1. Leadership and oversight'!G6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H6),\"\",'1. Leadership and oversight'!H6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I6),\"\",'1. Leadership and oversight'!I6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J6),\"\",'1. Leadership and oversight'!J6)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K6),\"\",'1. Leadership and oversight'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O6),\"\",'1. Leadership and oversight'!O6)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.6","Ensure job descriptions are up-to-date, fit for purpose and reviewed regularly.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E7),\"\",'1. Leadership and oversight'!E7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F7),\"\",'1. Leadership and oversight'!F7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G7),\"\",'1. Leadership and oversight'!G7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H7),\"\",'1. Leadership and oversight'!H7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I7),\"\",'1. Leadership and oversight'!I7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J7),\"\",'1. Leadership and oversight'!J7)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K7),\"\",'1. Leadership and oversight'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O7),\"\",'1. Leadership and oversight'!O7)","v":""}]
["Leadership and Oversight",1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.7","Ensure data protection and information governance staff understand the organisational structure and their responsibilities.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E8),\"\",'1. Leadership and oversight'!E8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F8),\"\",'1. Leadership and oversight'!F8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G8),\"\",'1. Leadership and oversight'!G8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H8),\"\",'1. Leadership and oversight'!H8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I8),\"\",'1. Leadership and oversight'!I8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J8),\"\",'1. Leadership and oversight'!J8)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K8),\"\",'1. Leadership and oversight'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O8),\"\",'1. Leadership and oversight'!O8)","v":""}]
["Leadership and Oversight",1.2000000000000002,"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.",1.2,"Ensure the DPO has specific responsibilities in line with Article 39 of the UK GDPR for data protection compliance, data protection policies, awareness raising, training and audits.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E9),\"\",'1. Leadership and oversight'!E9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F9),\"\",'1. Leadership and oversight'!F9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G9),\"\",'1. Leadership and oversight'!G9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H9),\"\",'1. Leadership and oversight'!H9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I9),\"\",'1. Leadership and oversight'!I9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J9),\"\",'1. Leadership and oversight'!J9)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K9),\"\",'1. Leadership and oversight'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O9),\"\",'1. Leadership and oversight'!O9)","v":""}]
["Leadership and Oversight",{"$f":"B10","v":1.2000000000000002},"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.","1.2.2","Ensure the DPO has expert knowledge of data protection law and practices.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E10),\"\",'1. Leadership and oversight'!E10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F10),\"\",'1. Leadership and oversight'!F10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G10),\"\",'1. Leadership and oversight'!G10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H10),\"\",'1. Leadership and oversight'!H10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I10),\"\",'1. Leadership and oversight'!I10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J10),\"\",'1. Leadership and oversight'!J10)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K10),\"\",'1. Leadership and oversight'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O10),\"\",'1. Leadership and oversight'!O10)","v":""}]
["Leadership and Oversight",1.2000000000000002,"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.","1.2.3","Ensure the DPO has the authority, support and resources to do their job effectively.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E11),\"\",'1. Leadership and oversight'!E11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F11),\"\",'1. Leadership and oversight'!F11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G11),\"\",'1. Leadership and oversight'!G11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H11),\"\",'1. Leadership and oversight'!H11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I11),\"\",'1. Leadership and oversight'!I11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J11),\"\",'1. Leadership and oversight'!J11)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K11),\"\",'1. Leadership and oversight'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O11),\"\",'1. Leadership and oversight'!O11)","v":""}]
["Leadership and Oversight",1.2000000000000002,"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.","1.2.4","Document the decision and rationale for not appointing a DPO, if that is the case. ",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E12),\"\",'1. Leadership and oversight'!E12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F12),\"\",'1. Leadership and oversight'!F12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G12),\"\",'1. Leadership and oversight'!G12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H12),\"\",'1. Leadership and oversight'!H12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I12),\"\",'1. Leadership and oversight'!I12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J12),\"\",'1. Leadership and oversight'!J12)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K12),\"\",'1. Leadership and oversight'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O12),\"\",'1. Leadership and oversight'!O12)","v":""}]
["Leadership and Oversight",1.2000000000000002,"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.","1.2.5","If your organisation is not required to appoint a DPO, assign responsibility for data protection compliance and ensure there are enough staff and resources to discharge data protection compliance obligations.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E13),\"\",'1. Leadership and oversight'!E13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F13),\"\",'1. Leadership and oversight'!F13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G13),\"\",'1. Leadership and oversight'!G13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H13),\"\",'1. Leadership and oversight'!H13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I13),\"\",'1. Leadership and oversight'!I13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J13),\"\",'1. Leadership and oversight'!J13)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K13),\"\",'1. Leadership and oversight'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O13),\"\",'1. Leadership and oversight'!O13)","v":""}]
["Leadership and Oversight",1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.1","Educate staff so they who the DPO is, what their role is and how to contact them.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E14),\"\",'1. Leadership and oversight'!E14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F14),\"\",'1. Leadership and oversight'!F14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G14),\"\",'1. Leadership and oversight'!G14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H14),\"\",'1. Leadership and oversight'!H14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I14),\"\",'1. Leadership and oversight'!I14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J14),\"\",'1. Leadership and oversight'!J14)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K14),\"\",'1. Leadership and oversight'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O14),\"\",'1. Leadership and oversight'!O14)","v":""}]
["Leadership and Oversight",{"$f":"B15","v":1.3000000000000003},"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.2","Involve the DPO in all data protection issues in a timely manner.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E15),\"\",'1. Leadership and oversight'!E15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F15),\"\",'1. Leadership and oversight'!F15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G15),\"\",'1. Leadership and oversight'!G15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H15),\"\",'1. Leadership and oversight'!H15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I15),\"\",'1. Leadership and oversight'!I15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J15),\"\",'1. Leadership and oversight'!J15)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K15),\"\",'1. Leadership and oversight'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O15),\"\",'1. Leadership and oversight'!O15)","v":""}]
["Leadership and Oversight",1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.3","Demonstrate that you follow the DPO’s advice and take account of their knowledge about data protection obligations.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E16),\"\",'1. Leadership and oversight'!E16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F16),\"\",'1. Leadership and oversight'!F16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G16),\"\",'1. Leadership and oversight'!G16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H16),\"\",'1. Leadership and oversight'!H16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I16),\"\",'1. Leadership and oversight'!I16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J16),\"\",'1. Leadership and oversight'!J16)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K16),\"\",'1. Leadership and oversight'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O16),\"\",'1. Leadership and oversight'!O16)","v":""}]
["Leadership and Oversight",1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.4","Ensure the DPO performs their tasks independently, without any conflicts of interest, and does not take any direct operational decisions about the manner and purposes of processing personal information within your organisation.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E17),\"\",'1. Leadership and oversight'!E17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F17),\"\",'1. Leadership and oversight'!F17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G17),\"\",'1. Leadership and oversight'!G17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H17),\"\",'1. Leadership and oversight'!H17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I17),\"\",'1. Leadership and oversight'!I17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J17),\"\",'1. Leadership and oversight'!J17)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K17),\"\",'1. Leadership and oversight'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O17),\"\",'1. Leadership and oversight'!O17)","v":""}]
["Leadership and Oversight",1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.5","Evidence that the DPO directly advises senior decision-makers and has the ability to raise concerns with the highest management level.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E18),\"\",'1. Leadership and oversight'!E18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F18),\"\",'1. Leadership and oversight'!F18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G18),\"\",'1. Leadership and oversight'!G18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H18),\"\",'1. Leadership and oversight'!H18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I18),\"\",'1. Leadership and oversight'!I18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J18),\"\",'1. Leadership and oversight'!J18)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K18),\"\",'1. Leadership and oversight'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O18),\"\",'1. Leadership and oversight'!O18)","v":""}]
["Leadership and Oversight",1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.6","Ensure the DPO provides senior management with regular updates about data protection compliance.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E19),\"\",'1. Leadership and oversight'!E19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F19),\"\",'1. Leadership and oversight'!F19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G19),\"\",'1. Leadership and oversight'!G19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H19),\"\",'1. Leadership and oversight'!H19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I19),\"\",'1. Leadership and oversight'!I19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J19),\"\",'1. Leadership and oversight'!J19)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K19),\"\",'1. Leadership and oversight'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O19),\"\",'1. Leadership and oversight'!O19)","v":""}]
["Leadership and Oversight",1.4000000000000004,"There are operational roles in place to support the practical implementation of data protection and information governance.","1.4.1","Ensure data protection and information governance staff have clear responsibilities to support your organisations data protection compliance.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E20),\"\",'1. Leadership and oversight'!E20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F20),\"\",'1. Leadership and oversight'!F20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G20),\"\",'1. Leadership and oversight'!G20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H20),\"\",'1. Leadership and oversight'!H20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I20),\"\",'1. Leadership and oversight'!I20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J20),\"\",'1. Leadership and oversight'!J20)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K20),\"\",'1. Leadership and oversight'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O20),\"\",'1. Leadership and oversight'!O20)","v":""}]
["Leadership and Oversight",{"$f":"B21","v":1.4000000000000004},"There are operational roles in place to support the practical implementation of data protection and information governance.","1.4.2","Manage all records effectively and keep information secure.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E21),\"\",'1. Leadership and oversight'!E21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F21),\"\",'1. Leadership and oversight'!F21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G21),\"\",'1. Leadership and oversight'!G21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H21),\"\",'1. Leadership and oversight'!H21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I21),\"\",'1. Leadership and oversight'!I21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J21),\"\",'1. Leadership and oversight'!J21)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K21),\"\",'1. Leadership and oversight'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O21),\"\",'1. Leadership and oversight'!O21)","v":""}]
["Leadership and Oversight",1.4000000000000004,"There are operational roles in place to support the practical implementation of data protection and information governance.","1.4.3","Put in place a network of support or nominated data protection leads help to implement and maintain data protection policies at a local level.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E22),\"\",'1. Leadership and oversight'!E22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F22),\"\",'1. Leadership and oversight'!F22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G22),\"\",'1. Leadership and oversight'!G22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H22),\"\",'1. Leadership and oversight'!H22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I22),\"\",'1. Leadership and oversight'!I22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J22),\"\",'1. Leadership and oversight'!J22)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K22),\"\",'1. Leadership and oversight'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O22),\"\",'1. Leadership and oversight'!O22)","v":""}]
["Leadership and Oversight",1.4000000000000004,"There are operational roles in place to support the practical implementation of data protection and information governance.","1.4.4","Ensure data protection and information governance staff have the authority, support and resources to carry out their responsibilities effectively.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E23),\"\",'1. Leadership and oversight'!E23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F23),\"\",'1. Leadership and oversight'!F23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G23),\"\",'1. Leadership and oversight'!G23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H23),\"\",'1. Leadership and oversight'!H23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I23),\"\",'1. Leadership and oversight'!I23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J23),\"\",'1. Leadership and oversight'!J23)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K23),\"\",'1. Leadership and oversight'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O23),\"\",'1. Leadership and oversight'!O23)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.1","Ensure key staff, eg the DPO, regularly attend the oversight group meetings.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E24),\"\",'1. Leadership and oversight'!E24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F24),\"\",'1. Leadership and oversight'!F24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G24),\"\",'1. Leadership and oversight'!G24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H24),\"\",'1. Leadership and oversight'!H24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I24),\"\",'1. Leadership and oversight'!I24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J24),\"\",'1. Leadership and oversight'!J24)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K24),\"\",'1. Leadership and oversight'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O24),\"\",'1. Leadership and oversight'!O24)","v":""}]
["Leadership and Oversight",{"$f":"B25","v":1.5000000000000004},"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.2","Ensure an appropriately senior staff member chairs the group, eg the DPO or senior information risk owner (SIRO).",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E25),\"\",'1. Leadership and oversight'!E25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F25),\"\",'1. Leadership and oversight'!F25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G25),\"\",'1. Leadership and oversight'!G25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H25),\"\",'1. Leadership and oversight'!H25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I25),\"\",'1. Leadership and oversight'!I25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J25),\"\",'1. Leadership and oversight'!J25)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K25),\"\",'1. Leadership and oversight'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O25),\"\",'1. Leadership and oversight'!O25)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.3","Document clear terms of reference that set out the group's aims.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E26),\"\",'1. Leadership and oversight'!E26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F26),\"\",'1. Leadership and oversight'!F26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G26),\"\",'1. Leadership and oversight'!G26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H26),\"\",'1. Leadership and oversight'!H26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I26),\"\",'1. Leadership and oversight'!I26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J26),\"\",'1. Leadership and oversight'!J26)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K26),\"\",'1. Leadership and oversight'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O26),\"\",'1. Leadership and oversight'!O26)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.4","Take detailed meeting minutes to record discussions, actions and decisions.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E27),\"\",'1. Leadership and oversight'!E27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F27),\"\",'1. Leadership and oversight'!F27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G27),\"\",'1. Leadership and oversight'!G27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H27),\"\",'1. Leadership and oversight'!H27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I27),\"\",'1. Leadership and oversight'!I27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J27),\"\",'1. Leadership and oversight'!J27)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K27),\"\",'1. Leadership and oversight'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O27),\"\",'1. Leadership and oversight'!O27)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.5","Ensure the group covers a full range of data protection-related topics including key performance indicators (KPIs), issues and risks.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E28),\"\",'1. Leadership and oversight'!E28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F28),\"\",'1. Leadership and oversight'!F28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G28),\"\",'1. Leadership and oversight'!G28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H28),\"\",'1. Leadership and oversight'!H28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I28),\"\",'1. Leadership and oversight'!I28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J28),\"\",'1. Leadership and oversight'!J28)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K28),\"\",'1. Leadership and oversight'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O28),\"\",'1. Leadership and oversight'!O28)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.6","Feed outcomes into a work or action plan and regularly review the plan.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E29),\"\",'1. Leadership and oversight'!E29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F29),\"\",'1. Leadership and oversight'!F29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G29),\"\",'1. Leadership and oversight'!G29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H29),\"\",'1. Leadership and oversight'!H29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I29),\"\",'1. Leadership and oversight'!I29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J29),\"\",'1. Leadership and oversight'!J29)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K29),\"\",'1. Leadership and oversight'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O29),\"\",'1. Leadership and oversight'!O29)","v":""}]
["Leadership and Oversight",1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.7","Report data protection and information governance issues and risks covered at the oversight group to the board or highest management level.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E30),\"\",'1. Leadership and oversight'!E30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F30),\"\",'1. Leadership and oversight'!F30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G30),\"\",'1. Leadership and oversight'!G30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H30),\"\",'1. Leadership and oversight'!H30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I30),\"\",'1. Leadership and oversight'!I30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J30),\"\",'1. Leadership and oversight'!J30)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K30),\"\",'1. Leadership and oversight'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O30),\"\",'1. Leadership and oversight'!O30)","v":""}]
["Leadership and Oversight",1.6000000000000005,"There are operational level groups that meet to discuss and coordinate data protection and information governance activities.","1.6.1","Ensure the groups meet regularly and are attended by relevant staff.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E31),\"\",'1. Leadership and oversight'!E31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F31),\"\",'1. Leadership and oversight'!F31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G31),\"\",'1. Leadership and oversight'!G31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H31),\"\",'1. Leadership and oversight'!H31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I31),\"\",'1. Leadership and oversight'!I31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J31),\"\",'1. Leadership and oversight'!J31)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K31),\"\",'1. Leadership and oversight'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O31),\"\",'1. Leadership and oversight'!O31)","v":""}]
[{"$f":"A32","v":"Leadership and Oversight"},1.6000000000000005,"There are operational level groups that meet to discuss and coordinate data protection and information governance activities.","1.6.2","Take and produce minutes of the meetings and action plans.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E32),\"\",'1. Leadership and oversight'!E32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F32),\"\",'1. Leadership and oversight'!F32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G32),\"\",'1. Leadership and oversight'!G32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H32),\"\",'1. Leadership and oversight'!H32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I32),\"\",'1. Leadership and oversight'!I32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J32),\"\",'1. Leadership and oversight'!J32)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K32),\"\",'1. Leadership and oversight'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O32),\"\",'1. Leadership and oversight'!O32)","v":""}]
["Leadership and Oversight",1.6000000000000005,"There are operational level groups that meet to discuss and coordinate data protection and information governance activities.","1.6.3","Discuss appropriate data protection and information governance issues in the group.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E33),\"\",'1. Leadership and oversight'!E33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F33),\"\",'1. Leadership and oversight'!F33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G33),\"\",'1. Leadership and oversight'!G33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H33),\"\",'1. Leadership and oversight'!H33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I33),\"\",'1. Leadership and oversight'!I33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J33),\"\",'1. Leadership and oversight'!J33)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K33),\"\",'1. Leadership and oversight'!K33)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O33),\"\",'1. Leadership and oversight'!O33)","v":""}]
["Leadership and Oversight",1.6000000000000005,"There are operational level groups that meet to discuss and coordinate data protection and information governance activities.","1.6.4","Report any data protection and information governance issues and risks that arise to the oversight group.",{"$f":"IF(ISBLANK('1. Leadership and oversight'!E34),\"\",'1. Leadership and oversight'!E34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!F34),\"\",'1. Leadership and oversight'!F34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!G34),\"\",'1. Leadership and oversight'!G34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!H34),\"\",'1. Leadership and oversight'!H34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!I34),\"\",'1. Leadership and oversight'!I34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!J34),\"\",'1. Leadership and oversight'!J34)","v":""},{"$f":"IF(ISBLANK('1. Leadership and oversight'!K34),\"\",'1. Leadership and oversight'!K34)","v":""},null,null,null,{"$f":"IF(ISBLANK('1. Leadership and oversight'!O34),\"\",'1. Leadership and oversight'!O34)","v":""}]
["Policies and procedures ",2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.1","Ensure the policy framework stems from strategic business planning for data protection and information governance, which the highest level of management endorses.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E2),\"\",'2. Policies and procedures'!E2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F2),\"\",'2. Policies and procedures'!F2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G2),\"\",'2. Policies and procedures'!G2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H2),\"\",'2. Policies and procedures'!H2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I2),\"\",'2. Policies and procedures'!I2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J2),\"\",'2. Policies and procedures'!J2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K2),\"\",'2. Policies and procedures'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O2),\"\",'2. Policies and procedures'!O2)","v":""}]
[{"$f":"A36","v":"Policies and procedures "},{"$f":"B36","v":2.1},"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.2","Implement policies that cover data protection, records management and information security.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E3),\"\",'2. Policies and procedures'!E3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F3),\"\",'2. Policies and procedures'!F3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G3),\"\",'2. Policies and procedures'!G3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H3),\"\",'2. Policies and procedures'!H3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I3),\"\",'2. Policies and procedures'!I3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J3),\"\",'2. Policies and procedures'!J3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K3),\"\",'2. Policies and procedures'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O3),\"\",'2. Policies and procedures'!O3)","v":""}]
["Policies and procedures ",2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.3","Make operational procedures, guidance and manuals readily available to support data protection policies and provide direction to operational staff.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E4),\"\",'2. Policies and procedures'!E4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F4),\"\",'2. Policies and procedures'!F4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G4),\"\",'2. Policies and procedures'!G4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H4),\"\",'2. Policies and procedures'!H4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I4),\"\",'2. Policies and procedures'!I4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J4),\"\",'2. Policies and procedures'!J4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K4),\"\",'2. Policies and procedures'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O4),\"\",'2. Policies and procedures'!O4)","v":""}]
["Policies and procedures ",2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.4","Ensure policies and procedures clearly outline roles and responsibilities.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E5),\"\",'2. Policies and procedures'!E5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F5),\"\",'2. Policies and procedures'!F5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G5),\"\",'2. Policies and procedures'!G5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H5),\"\",'2. Policies and procedures'!H5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I5),\"\",'2. Policies and procedures'!I5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J5),\"\",'2. Policies and procedures'!J5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K5),\"\",'2. Policies and procedures'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O5),\"\",'2. Policies and procedures'!O5)","v":""}]
["Policies and procedures ",2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.1","Ensure all policies and procedures follow an agreed format and style.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E6),\"\",'2. Policies and procedures'!E6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F6),\"\",'2. Policies and procedures'!F6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G6),\"\",'2. Policies and procedures'!G6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H6),\"\",'2. Policies and procedures'!H6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I6),\"\",'2. Policies and procedures'!I6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J6),\"\",'2. Policies and procedures'!J6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K6),\"\",'2. Policies and procedures'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O6),\"\",'2. Policies and procedures'!O6)","v":""}]
["Policies and procedures ",{"$f":"B40","v":2.2000000000000002},"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.2","Ensure an appropriately senior staff member reviews and approves all new and existing policies and procedures.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E7),\"\",'2. Policies and procedures'!E7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F7),\"\",'2. Policies and procedures'!F7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G7),\"\",'2. Policies and procedures'!G7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H7),\"\",'2. Policies and procedures'!H7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I7),\"\",'2. Policies and procedures'!I7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J7),\"\",'2. Policies and procedures'!J7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K7),\"\",'2. Policies and procedures'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O7),\"\",'2. Policies and procedures'!O7)","v":""}]
["Policies and procedures ",2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.3","Review existing policies and procedures in line with documented review dates, so they are up-to-date and fit for purpose.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E8),\"\",'2. Policies and procedures'!E8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F8),\"\",'2. Policies and procedures'!F8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G8),\"\",'2. Policies and procedures'!G8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H8),\"\",'2. Policies and procedures'!H8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I8),\"\",'2. Policies and procedures'!I8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J8),\"\",'2. Policies and procedures'!J8)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K8),\"\",'2. Policies and procedures'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O8),\"\",'2. Policies and procedures'!O8)","v":""}]
["Policies and procedures ",2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.4","Update policies and procedures without undue delay when they require changes, eg because of operational change, court or regulatory decisions or changes in regulatory guidance.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E9),\"\",'2. Policies and procedures'!E9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F9),\"\",'2. Policies and procedures'!F9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G9),\"\",'2. Policies and procedures'!G9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H9),\"\",'2. Policies and procedures'!H9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I9),\"\",'2. Policies and procedures'!I9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J9),\"\",'2. Policies and procedures'!J9)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K9),\"\",'2. Policies and procedures'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O9),\"\",'2. Policies and procedures'!O9)","v":""}]
["Policies and procedures ",2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.5","Show document control information, including version number, owner, review date and change history in all policies, procedures and guidelines.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E10),\"\",'2. Policies and procedures'!E10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F10),\"\",'2. Policies and procedures'!F10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G10),\"\",'2. Policies and procedures'!G10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H10),\"\",'2. Policies and procedures'!H10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I10),\"\",'2. Policies and procedures'!I10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J10),\"\",'2. Policies and procedures'!J10)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K10),\"\",'2. Policies and procedures'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O10),\"\",'2. Policies and procedures'!O10)","v":""}]
["Policies and procedures ",2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.1","Ensure staff read and understand the policies and procedures, including why they are important to implement and comply with.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E11),\"\",'2. Policies and procedures'!E11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F11),\"\",'2. Policies and procedures'!F11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G11),\"\",'2. Policies and procedures'!G11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H11),\"\",'2. Policies and procedures'!H11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I11),\"\",'2. Policies and procedures'!I11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J11),\"\",'2. Policies and procedures'!J11)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K11),\"\",'2. Policies and procedures'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O11),\"\",'2. Policies and procedures'!O11)","v":""}]
["Policies and procedures ",{"$f":"B45","v":2.2999999999999998},"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.2","Tell staff about updated policies and procedures.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E12),\"\",'2. Policies and procedures'!E12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F12),\"\",'2. Policies and procedures'!F12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G12),\"\",'2. Policies and procedures'!G12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H12),\"\",'2. Policies and procedures'!H12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I12),\"\",'2. Policies and procedures'!I12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J12),\"\",'2. Policies and procedures'!J12)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K12),\"\",'2. Policies and procedures'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O12),\"\",'2. Policies and procedures'!O12)","v":""}]
["Policies and procedures ",2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.3","Make policies and procedures readily available for all staff on your organisation’s intranet site (or equivalent shared area) or provide them in other formats.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E13),\"\",'2. Policies and procedures'!E13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F13),\"\",'2. Policies and procedures'!F13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G13),\"\",'2. Policies and procedures'!G13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H13),\"\",'2. Policies and procedures'!H13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I13),\"\",'2. Policies and procedures'!I13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J13),\"\",'2. Policies and procedures'!J13)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K13),\"\",'2. Policies and procedures'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O13),\"\",'2. Policies and procedures'!O13)","v":""}]
["Policies and procedures ",2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.4","Use guidelines, posters or publications to help to emphasise key messages and raise staff awareness of policies and procedures.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E14),\"\",'2. Policies and procedures'!E14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F14),\"\",'2. Policies and procedures'!F14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G14),\"\",'2. Policies and procedures'!G14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H14),\"\",'2. Policies and procedures'!H14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I14),\"\",'2. Policies and procedures'!I14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J14),\"\",'2. Policies and procedures'!J14)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K14),\"\",'2. Policies and procedures'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O14),\"\",'2. Policies and procedures'!O14)","v":""}]
["Policies and procedures ",2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.1","Where relevant, consider policies and procedures across your organisation with data protection in mind.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E15),\"\",'2. Policies and procedures'!E15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F15),\"\",'2. Policies and procedures'!F15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G15),\"\",'2. Policies and procedures'!G15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H15),\"\",'2. Policies and procedures'!H15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I15),\"\",'2. Policies and procedures'!I15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J15),\"\",'2. Policies and procedures'!J15)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K15),\"\",'2. Policies and procedures'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O15),\"\",'2. Policies and procedures'!O15)","v":""}]
[{"$f":"A49","v":"Policies and procedures "},2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.2","Implement policies and procedures to ensure data protection issues are considered when systems, services, products and business practices involving personal information are designed and implemented, and that personal information is protected by default.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E16),\"\",'2. Policies and procedures'!E16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F16),\"\",'2. Policies and procedures'!F16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G16),\"\",'2. Policies and procedures'!G16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H16),\"\",'2. Policies and procedures'!H16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I16),\"\",'2. Policies and procedures'!I16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J16),\"\",'2. Policies and procedures'!J16)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K16),\"\",'2. Policies and procedures'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O16),\"\",'2. Policies and procedures'!O16)","v":""}]
["Policies and procedures ",2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.3","Set out your organisation’s approach to implementing the data protection principles and safeguarding people’s rights, such as data minimisation, pseudonymisation and purpose limitation, in policies and procedures.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E17),\"\",'2. Policies and procedures'!E17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F17),\"\",'2. Policies and procedures'!F17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G17),\"\",'2. Policies and procedures'!G17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H17),\"\",'2. Policies and procedures'!H17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I17),\"\",'2. Policies and procedures'!I17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J17),\"\",'2. Policies and procedures'!J17)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K17),\"\",'2. Policies and procedures'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O17),\"\",'2. Policies and procedures'!O17)","v":""}]
["Policies and procedures ",2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.4","Give the personal information of vulnerable groups, eg children, extra protection in policies and procedures.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E18),\"\",'2. Policies and procedures'!E18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F18),\"\",'2. Policies and procedures'!F18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G18),\"\",'2. Policies and procedures'!G18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H18),\"\",'2. Policies and procedures'!H18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I18),\"\",'2. Policies and procedures'!I18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J18),\"\",'2. Policies and procedures'!J18)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!K18),\"\",'2. Policies and procedures'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('2. Policies and procedures'!O18),\"\",'2. Policies and procedures'!O18)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.1","Incorporate national and sector-specific requirements in the training programme.",{"$f":"IF(ISBLANK('3. Training and awareness'!E2),\"\",'3. Training and awareness'!E2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F2),\"\",'3. Training and awareness'!F2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G2),\"\",'3. Training and awareness'!G2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H2),\"\",'3. Training and awareness'!H2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I2),\"\",'3. Training and awareness'!I2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J2),\"\",'3. Training and awareness'!J2)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K2),\"\",'3. Training and awareness'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O2),\"\",'3. Training and awareness'!O2)","v":""}]
[{"$f":"A53","v":"Training and awareness"},{"$f":"B53","v":3.1},"There is an all-staff data protection and information governance training programme.","3.1.2","Ensure the programme is comprehensive and includes training for all staff on key areas of data protection such as handling requests, data sharing, information security, personal data breaches and records management.",{"$f":"IF(ISBLANK('3. Training and awareness'!E3),\"\",'3. Training and awareness'!E3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F3),\"\",'3. Training and awareness'!F3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G3),\"\",'3. Training and awareness'!G3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H3),\"\",'3. Training and awareness'!H3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I3),\"\",'3. Training and awareness'!I3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J3),\"\",'3. Training and awareness'!J3)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K3),\"\",'3. Training and awareness'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O3),\"\",'3. Training and awareness'!O3)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.3","Consider the training needs of all staff and use this information to compile the training programme.",{"$f":"IF(ISBLANK('3. Training and awareness'!E4),\"\",'3. Training and awareness'!E4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F4),\"\",'3. Training and awareness'!F4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G4),\"\",'3. Training and awareness'!G4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H4),\"\",'3. Training and awareness'!H4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I4),\"\",'3. Training and awareness'!I4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J4),\"\",'3. Training and awareness'!J4)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K4),\"\",'3. Training and awareness'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O4),\"\",'3. Training and awareness'!O4)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.4","Assign responsibilities for managing information governance and data protection training across your organisation and have training plans or strategies in place to meet training needs within agreed time-scales.",{"$f":"IF(ISBLANK('3. Training and awareness'!E5),\"\",'3. Training and awareness'!E5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F5),\"\",'3. Training and awareness'!F5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G5),\"\",'3. Training and awareness'!G5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H5),\"\",'3. Training and awareness'!H5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I5),\"\",'3. Training and awareness'!I5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J5),\"\",'3. Training and awareness'!J5)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K5),\"\",'3. Training and awareness'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O5),\"\",'3. Training and awareness'!O5)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.5","Have dedicated and trained resources available to deliver training to all staff.",{"$f":"IF(ISBLANK('3. Training and awareness'!E6),\"\",'3. Training and awareness'!E6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F6),\"\",'3. Training and awareness'!F6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G6),\"\",'3. Training and awareness'!G6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H6),\"\",'3. Training and awareness'!H6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I6),\"\",'3. Training and awareness'!I6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J6),\"\",'3. Training and awareness'!J6)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K6),\"\",'3. Training and awareness'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O6),\"\",'3. Training and awareness'!O6)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.6","Regularly review the programme to ensure that it remains accurate and up to date.",{"$f":"IF(ISBLANK('3. Training and awareness'!E7),\"\",'3. Training and awareness'!E7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F7),\"\",'3. Training and awareness'!F7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G7),\"\",'3. Training and awareness'!G7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H7),\"\",'3. Training and awareness'!H7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I7),\"\",'3. Training and awareness'!I7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J7),\"\",'3. Training and awareness'!J7)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K7),\"\",'3. Training and awareness'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O7),\"\",'3. Training and awareness'!O7)","v":""}]
["Training and awareness",3.1,"There is an all-staff data protection and information governance training programme.","3.1.7","Require senior management to sign off the programme.",{"$f":"IF(ISBLANK('3. Training and awareness'!E8),\"\",'3. Training and awareness'!E8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F8),\"\",'3. Training and awareness'!F8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G8),\"\",'3. Training and awareness'!G8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H8),\"\",'3. Training and awareness'!H8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I8),\"\",'3. Training and awareness'!I8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J8),\"\",'3. Training and awareness'!J8)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K8),\"\",'3. Training and awareness'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O8),\"\",'3. Training and awareness'!O8)","v":""}]
["Training and awareness",3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.1","Ensure appropriate staff, such as the DPO or an information governance manager, oversee or approve induction training.",{"$f":"IF(ISBLANK('3. Training and awareness'!E9),\"\",'3. Training and awareness'!E9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F9),\"\",'3. Training and awareness'!F9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G9),\"\",'3. Training and awareness'!G9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H9),\"\",'3. Training and awareness'!H9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I9),\"\",'3. Training and awareness'!I9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J9),\"\",'3. Training and awareness'!J9)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K9),\"\",'3. Training and awareness'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O9),\"\",'3. Training and awareness'!O9)","v":""}]
["Training and awareness",{"$f":"B60","v":3.2},"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.2","Deliver induction and refresher training to all staff, regardless of how long they will be working for your organisation, their contractual status or grade.",{"$f":"IF(ISBLANK('3. Training and awareness'!E10),\"\",'3. Training and awareness'!E10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F10),\"\",'3. Training and awareness'!F10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G10),\"\",'3. Training and awareness'!G10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H10),\"\",'3. Training and awareness'!H10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I10),\"\",'3. Training and awareness'!I10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J10),\"\",'3. Training and awareness'!J10)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K10),\"\",'3. Training and awareness'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O10),\"\",'3. Training and awareness'!O10)","v":""}]
["Training and awareness",3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.3","Deliver induction training to all staff prior to accessing personal information and within one month of their start date.",{"$f":"IF(ISBLANK('3. Training and awareness'!E11),\"\",'3. Training and awareness'!E11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F11),\"\",'3. Training and awareness'!F11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G11),\"\",'3. Training and awareness'!G11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H11),\"\",'3. Training and awareness'!H11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I11),\"\",'3. Training and awareness'!I11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J11),\"\",'3. Training and awareness'!J11)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K11),\"\",'3. Training and awareness'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O11),\"\",'3. Training and awareness'!O11)","v":""}]
["Training and awareness",3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.4","Ensure staff complete refresher training at appropriate intervals.",{"$f":"IF(ISBLANK('3. Training and awareness'!E12),\"\",'3. Training and awareness'!E12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F12),\"\",'3. Training and awareness'!F12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G12),\"\",'3. Training and awareness'!G12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H12),\"\",'3. Training and awareness'!H12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I12),\"\",'3. Training and awareness'!I12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J12),\"\",'3. Training and awareness'!J12)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K12),\"\",'3. Training and awareness'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O12),\"\",'3. Training and awareness'!O12)","v":""}]
["Training and awareness",3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.1","Complete a training needs analysis for information governance and data protection staff to inform the training plan and to ensure it is specific to their responsibilities.",{"$f":"IF(ISBLANK('3. Training and awareness'!E13),\"\",'3. Training and awareness'!E13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F13),\"\",'3. Training and awareness'!F13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G13),\"\",'3. Training and awareness'!G13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H13),\"\",'3. Training and awareness'!H13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I13),\"\",'3. Training and awareness'!I13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J13),\"\",'3. Training and awareness'!J13)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K13),\"\",'3. Training and awareness'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O13),\"\",'3. Training and awareness'!O13)","v":""}]
["Training and awareness",{"$f":"B64","v":3.3},"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.2","Detail training and skills requirements in job descriptions.",{"$f":"IF(ISBLANK('3. Training and awareness'!E14),\"\",'3. Training and awareness'!E14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F14),\"\",'3. Training and awareness'!F14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G14),\"\",'3. Training and awareness'!G14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H14),\"\",'3. Training and awareness'!H14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I14),\"\",'3. Training and awareness'!I14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J14),\"\",'3. Training and awareness'!J14)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K14),\"\",'3. Training and awareness'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O14),\"\",'3. Training and awareness'!O14)","v":""}]
["Training and awareness",3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.3","Have evidence to confirm that key roles complete up-to-date and appropriate specialised training and professional development, and are subject to proportionate refresher training.",{"$f":"IF(ISBLANK('3. Training and awareness'!E15),\"\",'3. Training and awareness'!E15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F15),\"\",'3. Training and awareness'!F15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G15),\"\",'3. Training and awareness'!G15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H15),\"\",'3. Training and awareness'!H15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I15),\"\",'3. Training and awareness'!I15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J15),\"\",'3. Training and awareness'!J15)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K15),\"\",'3. Training and awareness'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O15),\"\",'3. Training and awareness'!O15)","v":""}]
["Training and awareness",3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.4","Keep on record copies of the training material provided as well as details of who received the training.",{"$f":"IF(ISBLANK('3. Training and awareness'!E16),\"\",'3. Training and awareness'!E16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F16),\"\",'3. Training and awareness'!F16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G16),\"\",'3. Training and awareness'!G16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H16),\"\",'3. Training and awareness'!H16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I16),\"\",'3. Training and awareness'!I16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J16),\"\",'3. Training and awareness'!J16)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K16),\"\",'3. Training and awareness'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O16),\"\",'3. Training and awareness'!O16)","v":""}]
["Training and awareness",3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.1","Conduct an assessment at the end of the training to test staff understanding and make sure that it is effective, which could include a minimum pass mark.",{"$f":"IF(ISBLANK('3. Training and awareness'!E17),\"\",'3. Training and awareness'!E17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F17),\"\",'3. Training and awareness'!F17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G17),\"\",'3. Training and awareness'!G17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H17),\"\",'3. Training and awareness'!H17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I17),\"\",'3. Training and awareness'!I17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J17),\"\",'3. Training and awareness'!J17)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K17),\"\",'3. Training and awareness'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O17),\"\",'3. Training and awareness'!O17)","v":""}]
["Training and awareness",{"$f":"B68","v":3.4},"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.2","Keep copies of the training material provided on record as well as details of who receives the training.",{"$f":"IF(ISBLANK('3. Training and awareness'!E18),\"\",'3. Training and awareness'!E18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F18),\"\",'3. Training and awareness'!F18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G18),\"\",'3. Training and awareness'!G18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H18),\"\",'3. Training and awareness'!H18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I18),\"\",'3. Training and awareness'!I18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J18),\"\",'3. Training and awareness'!J18)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K18),\"\",'3. Training and awareness'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O18),\"\",'3. Training and awareness'!O18)","v":""}]
["Training and awareness",3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.3","Monitor training completion in line with organisational requirements at all levels of the organisation, and follow up with staff who do not complete the training.",{"$f":"IF(ISBLANK('3. Training and awareness'!E19),\"\",'3. Training and awareness'!E19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F19),\"\",'3. Training and awareness'!F19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G19),\"\",'3. Training and awareness'!G19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H19),\"\",'3. Training and awareness'!H19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I19),\"\",'3. Training and awareness'!I19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J19),\"\",'3. Training and awareness'!J19)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K19),\"\",'3. Training and awareness'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O19),\"\",'3. Training and awareness'!O19)","v":""}]
["Training and awareness",3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.4","Enable staff to provide feedback on the training they receive.",{"$f":"IF(ISBLANK('3. Training and awareness'!E20),\"\",'3. Training and awareness'!E20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F20),\"\",'3. Training and awareness'!F20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G20),\"\",'3. Training and awareness'!G20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H20),\"\",'3. Training and awareness'!H20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I20),\"\",'3. Training and awareness'!I20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J20),\"\",'3. Training and awareness'!J20)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K20),\"\",'3. Training and awareness'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O20),\"\",'3. Training and awareness'!O20)","v":""}]
["Training and awareness",3.5,"Awareness is raised across the organisation of data protection, information governance and associated policies and procedures in meetings or staff forums. It is easy for staff to access relevant material.","3.5.1","Use a variety of appropriate methods to raise staff awareness and the profile of data protection and information governance, for example by emails, team briefings and meetings, posters, handouts and blogs.",{"$f":"IF(ISBLANK('3. Training and awareness'!E21),\"\",'3. Training and awareness'!E21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F21),\"\",'3. Training and awareness'!F21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G21),\"\",'3. Training and awareness'!G21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H21),\"\",'3. Training and awareness'!H21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I21),\"\",'3. Training and awareness'!I21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J21),\"\",'3. Training and awareness'!J21)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K21),\"\",'3. Training and awareness'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O21),\"\",'3. Training and awareness'!O21)","v":""}]
[{"$f":"A72","v":"Training and awareness"},3.5,"Awareness is raised across the organisation of data protection, information governance and associated policies and procedures in meetings or staff forums. It is easy for staff to access relevant material.","3.5.2","Make it easy for staff to access relevant material, and find out who to contact if they have any queries relating to data protection and information governance.",{"$f":"IF(ISBLANK('3. Training and awareness'!E22),\"\",'3. Training and awareness'!E22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!F22),\"\",'3. Training and awareness'!F22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!G22),\"\",'3. Training and awareness'!G22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!H22),\"\",'3. Training and awareness'!H22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!I22),\"\",'3. Training and awareness'!I22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!J22),\"\",'3. Training and awareness'!J22)","v":""},{"$f":"IF(ISBLANK('3. Training and awareness'!K22),\"\",'3. Training and awareness'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('3. Training and awareness'!O22),\"\",'3. Training and awareness'!O22)","v":""}]
["Information rights ",4.0999999999999996,"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.1","Give people clear and relevant information about their rights and how to exercise them.",{"$f":"IF(ISBLANK('4. Information rights'!E2),\"\",'4. Information rights'!E2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F2),\"\",'4. Information rights'!F2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G2),\"\",'4. Information rights'!G2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H2),\"\",'4. Information rights'!H2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I2),\"\",'4. Information rights'!I2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J2),\"\",'4. Information rights'!J2)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K2),\"\",'4. Information rights'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O2),\"\",'4. Information rights'!O2)","v":""}]
[{"$f":"A74","v":"Information rights "},{"$f":"B74","v":4.0999999999999996},"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.2","Set out processes for dealing with requests from people about their rights in policies and procedures.",{"$f":"IF(ISBLANK('4. Information rights'!E3),\"\",'4. Information rights'!E3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F3),\"\",'4. Information rights'!F3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G3),\"\",'4. Information rights'!G3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H3),\"\",'4. Information rights'!H3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I3),\"\",'4. Information rights'!I3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J3),\"\",'4. Information rights'!J3)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K3),\"\",'4. Information rights'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O3),\"\",'4. Information rights'!O3)","v":""}]
["Information rights ",4.0999999999999996,"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.3","Deliver training and guidance to all staff on how to recognise a request and where to send them.",{"$f":"IF(ISBLANK('4. Information rights'!E4),\"\",'4. Information rights'!E4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F4),\"\",'4. Information rights'!F4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G4),\"\",'4. Information rights'!G4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H4),\"\",'4. Information rights'!H4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I4),\"\",'4. Information rights'!I4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J4),\"\",'4. Information rights'!J4)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K4),\"\",'4. Information rights'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O4),\"\",'4. Information rights'!O4)","v":""}]
["Information rights ",4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.1","Ensure there is a specific person or team in place that are responsible for managing and responding to requests.",{"$f":"IF(ISBLANK('4. Information rights'!E5),\"\",'4. Information rights'!E5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F5),\"\",'4. Information rights'!F5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G5),\"\",'4. Information rights'!G5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H5),\"\",'4. Information rights'!H5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I5),\"\",'4. Information rights'!I5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J5),\"\",'4. Information rights'!J5)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K5),\"\",'4. Information rights'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O5),\"\",'4. Information rights'!O5)","v":""}]
["Information rights ",{"$f":"B77","v":4.2},"There are appropriate resources in place to handle requests from people about their information.","4.2.2","Ensure staff receive specialised training to handle requests, including regular refresher training.",{"$f":"IF(ISBLANK('4. Information rights'!E6),\"\",'4. Information rights'!E6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F6),\"\",'4. Information rights'!F6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G6),\"\",'4. Information rights'!G6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H6),\"\",'4. Information rights'!H6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I6),\"\",'4. Information rights'!I6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J6),\"\",'4. Information rights'!J6)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K6),\"\",'4. Information rights'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O6),\"\",'4. Information rights'!O6)","v":""}]
["Information rights ",4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.3","Have sufficient resources to deal with requests.",{"$f":"IF(ISBLANK('4. Information rights'!E7),\"\",'4. Information rights'!E7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F7),\"\",'4. Information rights'!F7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G7),\"\",'4. Information rights'!G7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H7),\"\",'4. Information rights'!H7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I7),\"\",'4. Information rights'!I7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J7),\"\",'4. Information rights'!J7)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K7),\"\",'4. Information rights'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O7),\"\",'4. Information rights'!O7)","v":""}]
["Information rights ",4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.4","If a staff member is absent, train other staff to carry out key tasks.",{"$f":"IF(ISBLANK('4. Information rights'!E8),\"\",'4. Information rights'!E8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F8),\"\",'4. Information rights'!F8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G8),\"\",'4. Information rights'!G8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H8),\"\",'4. Information rights'!H8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I8),\"\",'4. Information rights'!I8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J8),\"\",'4. Information rights'!J8)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K8),\"\",'4. Information rights'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O8),\"\",'4. Information rights'!O8)","v":""}]
["Information rights ",4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.5","Ensure you can deal with any increase in requests or reduction in staffing levels.",{"$f":"IF(ISBLANK('4. Information rights'!E9),\"\",'4. Information rights'!E9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F9),\"\",'4. Information rights'!F9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G9),\"\",'4. Information rights'!G9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H9),\"\",'4. Information rights'!H9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I9),\"\",'4. Information rights'!I9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J9),\"\",'4. Information rights'!J9)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K9),\"\",'4. Information rights'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O9),\"\",'4. Information rights'!O9)","v":""}]
["Information rights ",4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.1","Put processes in place to ensure the log is accurate and updated as appropriate.",{"$f":"IF(ISBLANK('4. Information rights'!E10),\"\",'4. Information rights'!E10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F10),\"\",'4. Information rights'!F10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G10),\"\",'4. Information rights'!G10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H10),\"\",'4. Information rights'!H10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I10),\"\",'4. Information rights'!I10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J10),\"\",'4. Information rights'!J10)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K10),\"\",'4. Information rights'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O10),\"\",'4. Information rights'!O10)","v":""}]
["Information rights ",{"$f":"B82","v":4.3},"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.2","Show the due date for requests, the actual date of the final response and the action taken on the log.",{"$f":"IF(ISBLANK('4. Information rights'!E11),\"\",'4. Information rights'!E11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F11),\"\",'4. Information rights'!F11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G11),\"\",'4. Information rights'!G11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H11),\"\",'4. Information rights'!H11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I11),\"\",'4. Information rights'!I11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J11),\"\",'4. Information rights'!J11)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K11),\"\",'4. Information rights'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O11),\"\",'4. Information rights'!O11)","v":""}]
["Information rights ",4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.3","Have a checklist that records the key stages in the request handling process, eg which systems or departments have been searched. This could be part of the log or a separate document.",{"$f":"IF(ISBLANK('4. Information rights'!E12),\"\",'4. Information rights'!E12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F12),\"\",'4. Information rights'!F12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G12),\"\",'4. Information rights'!G12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H12),\"\",'4. Information rights'!H12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I12),\"\",'4. Information rights'!I12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J12),\"\",'4. Information rights'!J12)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K12),\"\",'4. Information rights'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O12),\"\",'4. Information rights'!O12)","v":""}]
["Information rights ",4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.4","Keep records of your organisation's request responses, and any disclosed or withheld information.",{"$f":"IF(ISBLANK('4. Information rights'!E13),\"\",'4. Information rights'!E13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F13),\"\",'4. Information rights'!F13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G13),\"\",'4. Information rights'!G13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H13),\"\",'4. Information rights'!H13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I13),\"\",'4. Information rights'!I13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J13),\"\",'4. Information rights'!J13)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K13),\"\",'4. Information rights'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O13),\"\",'4. Information rights'!O13)","v":""}]
["Information rights ",4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.1","Action all requests within statutory timescales.",{"$f":"IF(ISBLANK('4. Information rights'!E14),\"\",'4. Information rights'!E14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F14),\"\",'4. Information rights'!F14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G14),\"\",'4. Information rights'!G14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H14),\"\",'4. Information rights'!H14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I14),\"\",'4. Information rights'!I14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J14),\"\",'4. Information rights'!J14)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K14),\"\",'4. Information rights'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O14),\"\",'4. Information rights'!O14)","v":""}]
["Information rights ",{"$f":"B86","v":4.4000000000000004},"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.2","Ensure staff responsible for managing requests meet regularly to discuss any issues and investigate, prioritise or escalate any delayed cases.",{"$f":"IF(ISBLANK('4. Information rights'!E15),\"\",'4. Information rights'!E15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F15),\"\",'4. Information rights'!F15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G15),\"\",'4. Information rights'!G15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H15),\"\",'4. Information rights'!H15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I15),\"\",'4. Information rights'!I15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J15),\"\",'4. Information rights'!J15)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K15),\"\",'4. Information rights'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O15),\"\",'4. Information rights'!O15)","v":""}]
["Information rights ",4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.3","If you need an extension, update people on the progress of their request and keep them informed.",{"$f":"IF(ISBLANK('4. Information rights'!E16),\"\",'4. Information rights'!E16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F16),\"\",'4. Information rights'!F16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G16),\"\",'4. Information rights'!G16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H16),\"\",'4. Information rights'!H16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I16),\"\",'4. Information rights'!I16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J16),\"\",'4. Information rights'!J16)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K16),\"\",'4. Information rights'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O16),\"\",'4. Information rights'!O16)","v":""}]
["Information rights ",4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.4","If a request is refused, have records about the reasons why and inform people about the reasons for any refusals or exemptions.",{"$f":"IF(ISBLANK('4. Information rights'!E17),\"\",'4. Information rights'!E17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F17),\"\",'4. Information rights'!F17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G17),\"\",'4. Information rights'!G17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H17),\"\",'4. Information rights'!H17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I17),\"\",'4. Information rights'!I17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J17),\"\",'4. Information rights'!J17)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K17),\"\",'4. Information rights'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O17),\"\",'4. Information rights'!O17)","v":""}]
["Information rights ",4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.1","Ensure staff responsible for managing requests meet regularly to discuss any issues.",{"$f":"IF(ISBLANK('4. Information rights'!E18),\"\",'4. Information rights'!E18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F18),\"\",'4. Information rights'!F18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G18),\"\",'4. Information rights'!G18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H18),\"\",'4. Information rights'!H18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I18),\"\",'4. Information rights'!I18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J18),\"\",'4. Information rights'!J18)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K18),\"\",'4. Information rights'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O18),\"\",'4. Information rights'!O18)","v":""}]
["Information rights ",{"$f":"B90","v":4.5},"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.2","Produce regular reports on performance and case quality assessments to ensure that requests are handled appropriately.",{"$f":"IF(ISBLANK('4. Information rights'!E19),\"\",'4. Information rights'!E19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F19),\"\",'4. Information rights'!F19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G19),\"\",'4. Information rights'!G19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H19),\"\",'4. Information rights'!H19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I19),\"\",'4. Information rights'!I19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J19),\"\",'4. Information rights'!J19)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K19),\"\",'4. Information rights'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O19),\"\",'4. Information rights'!O19)","v":""}]
["Information rights ",4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.3","Share reports with senior management, that they review and action at appropriate meetings.",{"$f":"IF(ISBLANK('4. Information rights'!E20),\"\",'4. Information rights'!E20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F20),\"\",'4. Information rights'!F20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G20),\"\",'4. Information rights'!G20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H20),\"\",'4. Information rights'!H20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I20),\"\",'4. Information rights'!I20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J20),\"\",'4. Information rights'!J20)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K20),\"\",'4. Information rights'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O20),\"\",'4. Information rights'!O20)","v":""}]
["Information rights ",4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.4","Analyse any trends in the nature or cause of requests to improve performance or reduce volumes.",{"$f":"IF(ISBLANK('4. Information rights'!E21),\"\",'4. Information rights'!E21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F21),\"\",'4. Information rights'!F21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G21),\"\",'4. Information rights'!G21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H21),\"\",'4. Information rights'!H21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I21),\"\",'4. Information rights'!I21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J21),\"\",'4. Information rights'!J21)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K21),\"\",'4. Information rights'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O21),\"\",'4. Information rights'!O21)","v":""}]
["Information rights ",4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.1","Take proportionate and reasonable steps to check the accuracy of the personal information held and, if necessary, be able to rectify it.",{"$f":"IF(ISBLANK('4. Information rights'!E22),\"\",'4. Information rights'!E22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F22),\"\",'4. Information rights'!F22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G22),\"\",'4. Information rights'!G22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H22),\"\",'4. Information rights'!H22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I22),\"\",'4. Information rights'!I22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J22),\"\",'4. Information rights'!J22)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K22),\"\",'4. Information rights'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O22),\"\",'4. Information rights'!O22)","v":""}]
["Information rights ",{"$f":"B94","v":4.5999999999999996},"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.2","If your organisation is satisfied that the information is accurate, have a procedure to explain this to people. You need to inform  people of their right to complain, and as a matter of good practice, record on the system the fact that the person disputes the accuracy of the information.",{"$f":"IF(ISBLANK('4. Information rights'!E23),\"\",'4. Information rights'!E23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F23),\"\",'4. Information rights'!F23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G23),\"\",'4. Information rights'!G23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H23),\"\",'4. Information rights'!H23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I23),\"\",'4. Information rights'!I23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J23),\"\",'4. Information rights'!J23)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K23),\"\",'4. Information rights'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O23),\"\",'4. Information rights'!O23)","v":""}]
["Information rights ",4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.3","If personal information has been disclosed to others, contact each recipient to inform them about the rectification, unless this is impossible or involves disproportionate effort.",{"$f":"IF(ISBLANK('4. Information rights'!E24),\"\",'4. Information rights'!E24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F24),\"\",'4. Information rights'!F24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G24),\"\",'4. Information rights'!G24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H24),\"\",'4. Information rights'!H24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I24),\"\",'4. Information rights'!I24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J24),\"\",'4. Information rights'!J24)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K24),\"\",'4. Information rights'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O24),\"\",'4. Information rights'!O24)","v":""}]
["Information rights ",4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.4","If asked, tell people which third parties have received their personal information.",{"$f":"IF(ISBLANK('4. Information rights'!E25),\"\",'4. Information rights'!E25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F25),\"\",'4. Information rights'!F25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G25),\"\",'4. Information rights'!G25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H25),\"\",'4. Information rights'!H25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I25),\"\",'4. Information rights'!I25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J25),\"\",'4. Information rights'!J25)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K25),\"\",'4. Information rights'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O25),\"\",'4. Information rights'!O25)","v":""}]
["Information rights ",4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.1","Erase personal information from back-up systems as well as live systems where necessary, and clearly tell people what will happen to their information.",{"$f":"IF(ISBLANK('4. Information rights'!E26),\"\",'4. Information rights'!E26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F26),\"\",'4. Information rights'!F26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G26),\"\",'4. Information rights'!G26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H26),\"\",'4. Information rights'!H26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I26),\"\",'4. Information rights'!I26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J26),\"\",'4. Information rights'!J26)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K26),\"\",'4. Information rights'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O26),\"\",'4. Information rights'!O26)","v":""}]
["Information rights ",{"$f":"B98","v":4.7},"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.2","If the personal information is disclosed to others, contact each recipient to inform them about the erasure, unless this is impossible or involves disproportionate effort.",{"$f":"IF(ISBLANK('4. Information rights'!E27),\"\",'4. Information rights'!E27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F27),\"\",'4. Information rights'!F27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G27),\"\",'4. Information rights'!G27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H27),\"\",'4. Information rights'!H27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I27),\"\",'4. Information rights'!I27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J27),\"\",'4. Information rights'!J27)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K27),\"\",'4. Information rights'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O27),\"\",'4. Information rights'!O27)","v":""}]
["Information rights ",4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.3","If asked to, tell people which third parties have received their personal information.",{"$f":"IF(ISBLANK('4. Information rights'!E28),\"\",'4. Information rights'!E28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F28),\"\",'4. Information rights'!F28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G28),\"\",'4. Information rights'!G28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H28),\"\",'4. Information rights'!H28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I28),\"\",'4. Information rights'!I28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J28),\"\",'4. Information rights'!J28)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K28),\"\",'4. Information rights'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O28),\"\",'4. Information rights'!O28)","v":""}]
["Information rights ",4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.4","If personal information has been made public in an online environment, take reasonable steps to tell other controllers, if they are processing it, to erase links to, copies or replication of that information.",{"$f":"IF(ISBLANK('4. Information rights'!E29),\"\",'4. Information rights'!E29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F29),\"\",'4. Information rights'!F29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G29),\"\",'4. Information rights'!G29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H29),\"\",'4. Information rights'!H29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I29),\"\",'4. Information rights'!I29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J29),\"\",'4. Information rights'!J29)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K29),\"\",'4. Information rights'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O29),\"\",'4. Information rights'!O29)","v":""}]
["Information rights ",4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.5","Give particular weight to a request for erasure where the processing is or was based on a child’s consent, especially when processing any personal information on the internet.",{"$f":"IF(ISBLANK('4. Information rights'!E30),\"\",'4. Information rights'!E30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F30),\"\",'4. Information rights'!F30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G30),\"\",'4. Information rights'!G30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H30),\"\",'4. Information rights'!H30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I30),\"\",'4. Information rights'!I30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J30),\"\",'4. Information rights'!J30)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K30),\"\",'4. Information rights'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O30),\"\",'4. Information rights'!O30)","v":""}]
["Information rights ",4.8,"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.1","Restrict personal information in a way appropriate for the type of processing and the system, for example temporarily moving the information to another system or removing it from a website.",{"$f":"IF(ISBLANK('4. Information rights'!E31),\"\",'4. Information rights'!E31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F31),\"\",'4. Information rights'!F31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G31),\"\",'4. Information rights'!G31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H31),\"\",'4. Information rights'!H31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I31),\"\",'4. Information rights'!I31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J31),\"\",'4. Information rights'!J31)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K31),\"\",'4. Information rights'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O31),\"\",'4. Information rights'!O31)","v":""}]
["Information rights ",{"$f":"B103","v":4.8},"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.2","If the personal information has been disclosed to others, contact each recipient to tell them about the restriction, unless this is impossible or involves disproportionate effort.",{"$f":"IF(ISBLANK('4. Information rights'!E32),\"\",'4. Information rights'!E32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F32),\"\",'4. Information rights'!F32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G32),\"\",'4. Information rights'!G32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H32),\"\",'4. Information rights'!H32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I32),\"\",'4. Information rights'!I32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J32),\"\",'4. Information rights'!J32)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K32),\"\",'4. Information rights'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O32),\"\",'4. Information rights'!O32)","v":""}]
["Information rights ",4.8,"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.3","If asked to, tell the requestor which third parties have received their personal information.",{"$f":"IF(ISBLANK('4. Information rights'!E33),\"\",'4. Information rights'!E33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F33),\"\",'4. Information rights'!F33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G33),\"\",'4. Information rights'!G33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H33),\"\",'4. Information rights'!H33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I33),\"\",'4. Information rights'!I33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J33),\"\",'4. Information rights'!J33)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K33),\"\",'4. Information rights'!K33)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O33),\"\",'4. Information rights'!O33)","v":""}]
["Information rights ",4.9000000000000004,"People are able to move, copy or transfer their personal information to another organisation securely, without affecting the information.","4.9.1","When requested, provide personal information in a structured, commonly used and machine readable format.",{"$f":"IF(ISBLANK('4. Information rights'!E34),\"\",'4. Information rights'!E34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F34),\"\",'4. Information rights'!F34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G34),\"\",'4. Information rights'!G34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H34),\"\",'4. Information rights'!H34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I34),\"\",'4. Information rights'!I34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J34),\"\",'4. Information rights'!J34)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K34),\"\",'4. Information rights'!K34)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O34),\"\",'4. Information rights'!O34)","v":""}]
["Information rights ",{"$f":"B106","v":4.9000000000000004},"People are able to move, copy or transfer their personal information to another organisation securely, without affecting the information.","4.9.2","Where possible and if a person requests it, directly transmit the information to another organisation.",{"$f":"IF(ISBLANK('4. Information rights'!E35),\"\",'4. Information rights'!E35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F35),\"\",'4. Information rights'!F35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G35),\"\",'4. Information rights'!G35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H35),\"\",'4. Information rights'!H35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I35),\"\",'4. Information rights'!I35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J35),\"\",'4. Information rights'!J35)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K35),\"\",'4. Information rights'!K35)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O35),\"\",'4. Information rights'!O35)","v":""}]
["Information rights ",4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.1","Complete additional checks for vulnerable groups, such as children, for all automated decision-making and profiling.",{"$f":"IF(ISBLANK('4. Information rights'!E36),\"\",'4. Information rights'!E36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F36),\"\",'4. Information rights'!F36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G36),\"\",'4. Information rights'!G36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H36),\"\",'4. Information rights'!H36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I36),\"\",'4. Information rights'!I36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J36),\"\",'4. Information rights'!J36)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K36),\"\",'4. Information rights'!K36)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O36),\"\",'4. Information rights'!O36)","v":""}]
["Information rights ",{"$f":"B108","v":4.0999999999999996},"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.2","Only collect the minimum information needed and have a clear retention policy for the profiles created.",{"$f":"IF(ISBLANK('4. Information rights'!E37),\"\",'4. Information rights'!E37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F37),\"\",'4. Information rights'!F37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G37),\"\",'4. Information rights'!G37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H37),\"\",'4. Information rights'!H37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I37),\"\",'4. Information rights'!I37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J37),\"\",'4. Information rights'!J37)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K37),\"\",'4. Information rights'!K37)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O37),\"\",'4. Information rights'!O37)","v":""}]
["Information rights ",4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.3","If your organisation uses solely automated decisions that have legal or similarly significant effects on people, have a recorded process to ensure these decisions only occur in accordance with article 22 of the UK GDPR. If this applies, carry out a data protection impact assessment (DPIA).",{"$f":"IF(ISBLANK('4. Information rights'!E38),\"\",'4. Information rights'!E38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F38),\"\",'4. Information rights'!F38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G38),\"\",'4. Information rights'!G38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H38),\"\",'4. Information rights'!H38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I38),\"\",'4. Information rights'!I38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J38),\"\",'4. Information rights'!J38)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K38),\"\",'4. Information rights'!K38)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O38),\"\",'4. Information rights'!O38)","v":""}]
["Information rights ",4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.4","Where the decision is solely automated and has legal or similarly significant effects on people, ensure a recorded process allows simple ways for people to request human intervention, express their opinion and challenge a decision.",{"$f":"IF(ISBLANK('4. Information rights'!E39),\"\",'4. Information rights'!E39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F39),\"\",'4. Information rights'!F39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G39),\"\",'4. Information rights'!G39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H39),\"\",'4. Information rights'!H39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I39),\"\",'4. Information rights'!I39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J39),\"\",'4. Information rights'!J39)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K39),\"\",'4. Information rights'!K39)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O39),\"\",'4. Information rights'!O39)","v":""}]
["Information rights ",4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.5","Conduct regular checks for accuracy and bias to ensure that systems are working as intended, and feed this back into the design process.",{"$f":"IF(ISBLANK('4. Information rights'!E40),\"\",'4. Information rights'!E40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F40),\"\",'4. Information rights'!F40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G40),\"\",'4. Information rights'!G40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H40),\"\",'4. Information rights'!H40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I40),\"\",'4. Information rights'!I40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J40),\"\",'4. Information rights'!J40)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K40),\"\",'4. Information rights'!K40)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O40),\"\",'4. Information rights'!O40)","v":""}]
["Information rights ",4.1100000000000003,"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.1","Implement procedures to handle data protection complaints raised by people and report their resolution to senior management.",{"$f":"IF(ISBLANK('4. Information rights'!E41),\"\",'4. Information rights'!E41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F41),\"\",'4. Information rights'!F41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G41),\"\",'4. Information rights'!G41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H41),\"\",'4. Information rights'!H41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I41),\"\",'4. Information rights'!I41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J41),\"\",'4. Information rights'!J41)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K41),\"\",'4. Information rights'!K41)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O41),\"\",'4. Information rights'!O41)","v":""}]
[{"$f":"A113","v":"Information rights "},4.1100000000000003,"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.2","Make the DPO’s contact details or alternative contact points publicly available if people wish to raise a complaint about the use of their information.",{"$f":"IF(ISBLANK('4. Information rights'!E42),\"\",'4. Information rights'!E42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F42),\"\",'4. Information rights'!F42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G42),\"\",'4. Information rights'!G42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H42),\"\",'4. Information rights'!H42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I42),\"\",'4. Information rights'!I42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J42),\"\",'4. Information rights'!J42)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K42),\"\",'4. Information rights'!K42)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O42),\"\",'4. Information rights'!O42)","v":""}]
["Information rights ",4.1100000000000003,"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.3","Tell people about their right to make a complaint to the ICO in your privacy information.",{"$f":"IF(ISBLANK('4. Information rights'!E43),\"\",'4. Information rights'!E43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!F43),\"\",'4. Information rights'!F43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!G43),\"\",'4. Information rights'!G43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!H43),\"\",'4. Information rights'!H43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!I43),\"\",'4. Information rights'!I43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!J43),\"\",'4. Information rights'!J43)","v":""},{"$f":"IF(ISBLANK('4. Information rights'!K43),\"\",'4. Information rights'!K43)","v":""},null,null,null,{"$f":"IF(ISBLANK('4. Information rights'!O43),\"\",'4. Information rights'!O43)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.1","Include all relevant contact information, eg the name and contact details of your organisation (and your representative if applicable) and the DPO’s contact details.",{"$f":"IF(ISBLANK('5. Transparency'!E2),\"\",'5. Transparency'!E2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F2),\"\",'5. Transparency'!F2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G2),\"\",'5. Transparency'!G2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H2),\"\",'5. Transparency'!H2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I2),\"\",'5. Transparency'!I2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J2),\"\",'5. Transparency'!J2)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K2),\"\",'5. Transparency'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O2),\"\",'5. Transparency'!O2)","v":""}]
[{"$f":"A116","v":"Transparency"},{"$f":"B116","v":5.0999999999999996},"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.2","Include the purposes of the processing and the lawful bases (and, if applicable, the legitimate interests for the processing).",{"$f":"IF(ISBLANK('5. Transparency'!E3),\"\",'5. Transparency'!E3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F3),\"\",'5. Transparency'!F3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G3),\"\",'5. Transparency'!G3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H3),\"\",'5. Transparency'!H3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I3),\"\",'5. Transparency'!I3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J3),\"\",'5. Transparency'!J3)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K3),\"\",'5. Transparency'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O3),\"\",'5. Transparency'!O3)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.3","Include the types of personal information you obtain and the information source, if the personal information is not obtained from the person it relates to.",{"$f":"IF(ISBLANK('5. Transparency'!E4),\"\",'5. Transparency'!E4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F4),\"\",'5. Transparency'!F4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G4),\"\",'5. Transparency'!G4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H4),\"\",'5. Transparency'!H4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I4),\"\",'5. Transparency'!I4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J4),\"\",'5. Transparency'!J4)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K4),\"\",'5. Transparency'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O4),\"\",'5. Transparency'!O4)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.4","Include details of all personal information that you share with other organisations and, if applicable, details of transfers to any third countries or international organisations.",{"$f":"IF(ISBLANK('5. Transparency'!E5),\"\",'5. Transparency'!E5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F5),\"\",'5. Transparency'!F5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G5),\"\",'5. Transparency'!G5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H5),\"\",'5. Transparency'!H5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I5),\"\",'5. Transparency'!I5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J5),\"\",'5. Transparency'!J5)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K5),\"\",'5. Transparency'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O5),\"\",'5. Transparency'!O5)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.5","Include retention periods for the personal information, or if that is not possible, the criteria used to determine the period.",{"$f":"IF(ISBLANK('5. Transparency'!E6),\"\",'5. Transparency'!E6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F6),\"\",'5. Transparency'!F6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G6),\"\",'5. Transparency'!G6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H6),\"\",'5. Transparency'!H6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I6),\"\",'5. Transparency'!I6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J6),\"\",'5. Transparency'!J6)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K6),\"\",'5. Transparency'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O6),\"\",'5. Transparency'!O6)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.6","Include details about people’s rights including, if applicable, the right to withdraw consent and the right to make a complaint.",{"$f":"IF(ISBLANK('5. Transparency'!E7),\"\",'5. Transparency'!E7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F7),\"\",'5. Transparency'!F7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G7),\"\",'5. Transparency'!G7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H7),\"\",'5. Transparency'!H7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I7),\"\",'5. Transparency'!I7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J7),\"\",'5. Transparency'!J7)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K7),\"\",'5. Transparency'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O7),\"\",'5. Transparency'!O7)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.7","Include details of whether people are under a statutory or contractual obligation to provide the personal information (if applicable, and if you collect the personal information from the person it relates to).",{"$f":"IF(ISBLANK('5. Transparency'!E8),\"\",'5. Transparency'!E8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F8),\"\",'5. Transparency'!F8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G8),\"\",'5. Transparency'!G8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H8),\"\",'5. Transparency'!H8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I8),\"\",'5. Transparency'!I8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J8),\"\",'5. Transparency'!J8)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K8),\"\",'5. Transparency'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O8),\"\",'5. Transparency'!O8)","v":""}]
["Transparency",5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.8","Provide people with privacy information regarding the source of the personal information if you don’t obtain it from the person concerned, eg if the information is from publicly accessible sources such as social media, the open electoral register or Companies House.",{"$f":"IF(ISBLANK('5. Transparency'!E9),\"\",'5. Transparency'!E9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F9),\"\",'5. Transparency'!F9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G9),\"\",'5. Transparency'!G9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H9),\"\",'5. Transparency'!H9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I9),\"\",'5. Transparency'!I9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J9),\"\",'5. Transparency'!J9)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K9),\"\",'5. Transparency'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O9),\"\",'5. Transparency'!O9)","v":""}]
["Transparency",5.2,"There is a recorded procedure to make sure that people receive privacy information at the right time, unless an exemption applies.","5.2.1","Provide people with privacy information when their information is collected (eg when they fill in a form) or by observation (eg when using CCTV or people are tracked online).",{"$f":"IF(ISBLANK('5. Transparency'!E10),\"\",'5. Transparency'!E10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F10),\"\",'5. Transparency'!F10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G10),\"\",'5. Transparency'!G10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H10),\"\",'5. Transparency'!H10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I10),\"\",'5. Transparency'!I10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J10),\"\",'5. Transparency'!J10)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K10),\"\",'5. Transparency'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O10),\"\",'5. Transparency'!O10)","v":""}]
["Transparency",{"$f":"B124","v":5.2},"There is a recorded procedure to make sure that people receive privacy information at the right time, unless an exemption applies.","5.2.2","If you obtain personal information from a source other than the person it relates to, provide privacy information to people, no later than one month after obtaining the information.",{"$f":"IF(ISBLANK('5. Transparency'!E11),\"\",'5. Transparency'!E11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F11),\"\",'5. Transparency'!F11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G11),\"\",'5. Transparency'!G11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H11),\"\",'5. Transparency'!H11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I11),\"\",'5. Transparency'!I11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J11),\"\",'5. Transparency'!J11)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K11),\"\",'5. Transparency'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O11),\"\",'5. Transparency'!O11)","v":""}]
["Transparency",5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.1","Proactively make people aware of privacy information and ensure they have a free, easy way to access it.",{"$f":"IF(ISBLANK('5. Transparency'!E12),\"\",'5. Transparency'!E12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F12),\"\",'5. Transparency'!F12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G12),\"\",'5. Transparency'!G12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H12),\"\",'5. Transparency'!H12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I12),\"\",'5. Transparency'!I12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J12),\"\",'5. Transparency'!J12)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K12),\"\",'5. Transparency'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O12),\"\",'5. Transparency'!O12)","v":""}]
["Transparency",{"$f":"B126","v":5.3},"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.2","Provide privacy information to people in electronic and hard-copy form, using a combination of appropriate techniques, such as a layered approach, icons and mobile and smart device functionalities.",{"$f":"IF(ISBLANK('5. Transparency'!E13),\"\",'5. Transparency'!E13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F13),\"\",'5. Transparency'!F13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G13),\"\",'5. Transparency'!G13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H13),\"\",'5. Transparency'!H13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I13),\"\",'5. Transparency'!I13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J13),\"\",'5. Transparency'!J13)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K13),\"\",'5. Transparency'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O13),\"\",'5. Transparency'!O13)","v":""}]
["Transparency",5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.3","Write privacy information in clear and plain language that the intended audience can understand, and offer it in accessible formats if required.",{"$f":"IF(ISBLANK('5. Transparency'!E14),\"\",'5. Transparency'!E14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F14),\"\",'5. Transparency'!F14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G14),\"\",'5. Transparency'!G14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H14),\"\",'5. Transparency'!H14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I14),\"\",'5. Transparency'!I14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J14),\"\",'5. Transparency'!J14)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K14),\"\",'5. Transparency'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O14),\"\",'5. Transparency'!O14)","v":""}]
["Transparency",5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.4","Take particular care to write privacy information for children in clear, plain language, that is age-appropriate, and explains the risks involved in the processing and what safeguards are in place.",{"$f":"IF(ISBLANK('5. Transparency'!E15),\"\",'5. Transparency'!E15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F15),\"\",'5. Transparency'!F15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G15),\"\",'5. Transparency'!G15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H15),\"\",'5. Transparency'!H15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I15),\"\",'5. Transparency'!I15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J15),\"\",'5. Transparency'!J15)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K15),\"\",'5. Transparency'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O15),\"\",'5. Transparency'!O15)","v":""}]
["Transparency",5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.1","Implement procedures for people to access the personal information you use to create profiles, so they can review for accuracy and edit it if needed.",{"$f":"IF(ISBLANK('5. Transparency'!E16),\"\",'5. Transparency'!E16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F16),\"\",'5. Transparency'!F16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G16),\"\",'5. Transparency'!G16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H16),\"\",'5. Transparency'!H16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I16),\"\",'5. Transparency'!I16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J16),\"\",'5. Transparency'!J16)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K16),\"\",'5. Transparency'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O16),\"\",'5. Transparency'!O16)","v":""}]
["Transparency",{"$f":"B130","v":5.4},"Processing relating to automated decision-making and profiling is transparent.","5.4.2","If the decision is solely automated and has legal or similarly significant effects, tell people about the processing - including what information you are using, why and what the impact is likely to be.",{"$f":"IF(ISBLANK('5. Transparency'!E17),\"\",'5. Transparency'!E17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F17),\"\",'5. Transparency'!F17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G17),\"\",'5. Transparency'!G17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H17),\"\",'5. Transparency'!H17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I17),\"\",'5. Transparency'!I17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J17),\"\",'5. Transparency'!J17)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K17),\"\",'5. Transparency'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O17),\"\",'5. Transparency'!O17)","v":""}]
["Transparency",5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.3","If the purpose is initially unclear, give people an indication of what your organisation is going to do with their information, and proactively update your privacy information as this becomes clearer.",{"$f":"IF(ISBLANK('5. Transparency'!E18),\"\",'5. Transparency'!E18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F18),\"\",'5. Transparency'!F18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G18),\"\",'5. Transparency'!G18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H18),\"\",'5. Transparency'!H18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I18),\"\",'5. Transparency'!I18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J18),\"\",'5. Transparency'!J18)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K18),\"\",'5. Transparency'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O18),\"\",'5. Transparency'!O18)","v":""}]
["Transparency",5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.4","If the decision is solely automated and has legal or similarly significant effects, explain the processing in a meaningful way that enables people to exercise their rights including obtaining human intervention, expressing their point of view and contesting the decision. ",{"$f":"IF(ISBLANK('5. Transparency'!E19),\"\",'5. Transparency'!E19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F19),\"\",'5. Transparency'!F19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G19),\"\",'5. Transparency'!G19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H19),\"\",'5. Transparency'!H19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I19),\"\",'5. Transparency'!I19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J19),\"\",'5. Transparency'!J19)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K19),\"\",'5. Transparency'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O19),\"\",'5. Transparency'!O19)","v":""}]
["Transparency",5.5,"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.1","Arrange organisation-wide staff training about privacy information.",{"$f":"IF(ISBLANK('5. Transparency'!E20),\"\",'5. Transparency'!E20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F20),\"\",'5. Transparency'!F20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G20),\"\",'5. Transparency'!G20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H20),\"\",'5. Transparency'!H20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I20),\"\",'5. Transparency'!I20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J20),\"\",'5. Transparency'!J20)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K20),\"\",'5. Transparency'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O20),\"\",'5. Transparency'!O20)","v":""}]
["Transparency",{"$f":"B134","v":5.5},"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.2","Ensure front-line staff receive more specialised or specific training.",{"$f":"IF(ISBLANK('5. Transparency'!E21),\"\",'5. Transparency'!E21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F21),\"\",'5. Transparency'!F21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G21),\"\",'5. Transparency'!G21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H21),\"\",'5. Transparency'!H21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I21),\"\",'5. Transparency'!I21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J21),\"\",'5. Transparency'!J21)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K21),\"\",'5. Transparency'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O21),\"\",'5. Transparency'!O21)","v":""}]
["Transparency",5.5,"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.3","Make staff aware of the various ways in which the organisation provides privacy information.",{"$f":"IF(ISBLANK('5. Transparency'!E22),\"\",'5. Transparency'!E22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F22),\"\",'5. Transparency'!F22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G22),\"\",'5. Transparency'!G22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H22),\"\",'5. Transparency'!H22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I22),\"\",'5. Transparency'!I22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J22),\"\",'5. Transparency'!J22)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K22),\"\",'5. Transparency'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O22),\"\",'5. Transparency'!O22)","v":""}]
["Transparency",5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.1","Review privacy information against the records of processing activities, to ensure it remains up to date and that it accurately explains what happens with peoples personal information.",{"$f":"IF(ISBLANK('5. Transparency'!E23),\"\",'5. Transparency'!E23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F23),\"\",'5. Transparency'!F23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G23),\"\",'5. Transparency'!G23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H23),\"\",'5. Transparency'!H23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I23),\"\",'5. Transparency'!I23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J23),\"\",'5. Transparency'!J23)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K23),\"\",'5. Transparency'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O23),\"\",'5. Transparency'!O23)","v":""}]
["Transparency",{"$f":"B137","v":5.6},"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.2","Maintain a log of historical privacy notices, including the dates you made any changes, in order to allow a review of what privacy information you provided to people and when.",{"$f":"IF(ISBLANK('5. Transparency'!E24),\"\",'5. Transparency'!E24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F24),\"\",'5. Transparency'!F24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G24),\"\",'5. Transparency'!G24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H24),\"\",'5. Transparency'!H24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I24),\"\",'5. Transparency'!I24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J24),\"\",'5. Transparency'!J24)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K24),\"\",'5. Transparency'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O24),\"\",'5. Transparency'!O24)","v":""}]
["Transparency",5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.3","Carry out user testing to evaluate the privacy information’s effectiveness.",{"$f":"IF(ISBLANK('5. Transparency'!E25),\"\",'5. Transparency'!E25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F25),\"\",'5. Transparency'!F25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G25),\"\",'5. Transparency'!G25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H25),\"\",'5. Transparency'!H25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I25),\"\",'5. Transparency'!I25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J25),\"\",'5. Transparency'!J25)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K25),\"\",'5. Transparency'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O25),\"\",'5. Transparency'!O25)","v":""}]
["Transparency",5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.4","Analyse complaints from the public about how you use their personal information, and in particular, any complaints about how you explain that use.",{"$f":"IF(ISBLANK('5. Transparency'!E26),\"\",'5. Transparency'!E26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F26),\"\",'5. Transparency'!F26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G26),\"\",'5. Transparency'!G26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H26),\"\",'5. Transparency'!H26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I26),\"\",'5. Transparency'!I26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J26),\"\",'5. Transparency'!J26)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K26),\"\",'5. Transparency'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O26),\"\",'5. Transparency'!O26)","v":""}]
["Transparency",5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.5","If your organisation plans to use personal information for a new purpose, implement a procedure to update the privacy information and communicate the changes to people before starting any new processing.",{"$f":"IF(ISBLANK('5. Transparency'!E27),\"\",'5. Transparency'!E27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F27),\"\",'5. Transparency'!F27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G27),\"\",'5. Transparency'!G27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H27),\"\",'5. Transparency'!H27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I27),\"\",'5. Transparency'!I27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J27),\"\",'5. Transparency'!J27)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K27),\"\",'5. Transparency'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O27),\"\",'5. Transparency'!O27)","v":""}]
["Transparency",5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.1","Ensure privacy policies are clear and easy for members of the public to access.",{"$f":"IF(ISBLANK('5. Transparency'!E28),\"\",'5. Transparency'!E28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F28),\"\",'5. Transparency'!F28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G28),\"\",'5. Transparency'!G28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H28),\"\",'5. Transparency'!H28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I28),\"\",'5. Transparency'!I28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J28),\"\",'5. Transparency'!J28)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K28),\"\",'5. Transparency'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O28),\"\",'5. Transparency'!O28)","v":""}]
[{"$f":"A142","v":"Transparency"},5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.2","Provide people with tools, such as secure self-service systems, dashboards and just-in-time notices, so they can access, determine and manage how your organisation uses their personal information.",{"$f":"IF(ISBLANK('5. Transparency'!E29),\"\",'5. Transparency'!E29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F29),\"\",'5. Transparency'!F29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G29),\"\",'5. Transparency'!G29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H29),\"\",'5. Transparency'!H29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I29),\"\",'5. Transparency'!I29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J29),\"\",'5. Transparency'!J29)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K29),\"\",'5. Transparency'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O29),\"\",'5. Transparency'!O29)","v":""}]
["Transparency",5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.3","Offer strong privacy defaults and user-friendly options and controls.",{"$f":"IF(ISBLANK('5. Transparency'!E30),\"\",'5. Transparency'!E30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F30),\"\",'5. Transparency'!F30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G30),\"\",'5. Transparency'!G30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H30),\"\",'5. Transparency'!H30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I30),\"\",'5. Transparency'!I30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J30),\"\",'5. Transparency'!J30)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K30),\"\",'5. Transparency'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O30),\"\",'5. Transparency'!O30)","v":""}]
["Transparency",5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.4","Where relevant, have processes in place to help children exercise their data protection rights in an easily accessible way that they understand.",{"$f":"IF(ISBLANK('5. Transparency'!E31),\"\",'5. Transparency'!E31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F31),\"\",'5. Transparency'!F31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G31),\"\",'5. Transparency'!G31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H31),\"\",'5. Transparency'!H31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I31),\"\",'5. Transparency'!I31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J31),\"\",'5. Transparency'!J31)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K31),\"\",'5. Transparency'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O31),\"\",'5. Transparency'!O31)","v":""}]
["Transparency",5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.5","Implement appropriate measures to protect children using digital services.",{"$f":"IF(ISBLANK('5. Transparency'!E32),\"\",'5. Transparency'!E32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!F32),\"\",'5. Transparency'!F32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!G32),\"\",'5. Transparency'!G32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!H32),\"\",'5. Transparency'!H32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!I32),\"\",'5. Transparency'!I32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!J32),\"\",'5. Transparency'!J32)","v":""},{"$f":"IF(ISBLANK('5. Transparency'!K32),\"\",'5. Transparency'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('5. Transparency'!O32),\"\",'5. Transparency'!O32)","v":""}]
["Records of processing and lawful basis ",6.1,"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.1","Carry out information audits (or data mapping exercises) to find out what personal information is held and to understand how the information flows through your organisation.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E2),\"\",'6 ROPA and lawful basis'!E2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F2),\"\",'6 ROPA and lawful basis'!F2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G2),\"\",'6 ROPA and lawful basis'!G2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H2),\"\",'6 ROPA and lawful basis'!H2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I2),\"\",'6 ROPA and lawful basis'!I2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J2),\"\",'6 ROPA and lawful basis'!J2)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K2),\"\",'6 ROPA and lawful basis'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O2),\"\",'6 ROPA and lawful basis'!O2)","v":""}]
[{"$f":"A147","v":"Records of processing and lawful basis "},{"$f":"B147","v":6.1},"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.2","Keep the data map up to date and clearly assign the responsibilities for maintaining and amending it.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E3),\"\",'6 ROPA and lawful basis'!E3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F3),\"\",'6 ROPA and lawful basis'!F3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G3),\"\",'6 ROPA and lawful basis'!G3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H3),\"\",'6 ROPA and lawful basis'!H3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I3),\"\",'6 ROPA and lawful basis'!I3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J3),\"\",'6 ROPA and lawful basis'!J3)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K3),\"\",'6 ROPA and lawful basis'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O3),\"\",'6 ROPA and lawful basis'!O3)","v":""}]
["Records of processing and lawful basis ",6.1,"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.3","Consult staff to make sure that there is an accurate picture of processing activities, for example by using questionnaires and staff surveys.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E4),\"\",'6 ROPA and lawful basis'!E4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F4),\"\",'6 ROPA and lawful basis'!F4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G4),\"\",'6 ROPA and lawful basis'!G4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H4),\"\",'6 ROPA and lawful basis'!H4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I4),\"\",'6 ROPA and lawful basis'!I4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J4),\"\",'6 ROPA and lawful basis'!J4)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K4),\"\",'6 ROPA and lawful basis'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O4),\"\",'6 ROPA and lawful basis'!O4)","v":""}]
["Records of processing and lawful basis ",6.2,"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.1","Record processing activities in electronic form so you can add, remove and amend information easily.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E5),\"\",'6 ROPA and lawful basis'!E5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F5),\"\",'6 ROPA and lawful basis'!F5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G5),\"\",'6 ROPA and lawful basis'!G5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H5),\"\",'6 ROPA and lawful basis'!H5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I5),\"\",'6 ROPA and lawful basis'!I5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J5),\"\",'6 ROPA and lawful basis'!J5)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K5),\"\",'6 ROPA and lawful basis'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O5),\"\",'6 ROPA and lawful basis'!O5)","v":""}]
["Records of processing and lawful basis ",{"$f":"B150","v":6.2},"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.2","Review the record against processing activities, policies and procedures to ensure that it remains accurate and up to date, and clearly assign responsibilities for doing this.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E6),\"\",'6 ROPA and lawful basis'!E6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F6),\"\",'6 ROPA and lawful basis'!F6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G6),\"\",'6 ROPA and lawful basis'!G6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H6),\"\",'6 ROPA and lawful basis'!H6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I6),\"\",'6 ROPA and lawful basis'!I6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J6),\"\",'6 ROPA and lawful basis'!J6)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K6),\"\",'6 ROPA and lawful basis'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O6),\"\",'6 ROPA and lawful basis'!O6)","v":""}]
["Records of processing and lawful basis ",6.2,"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.3","Regularly review the processing activities and types of information you process for data minimisation purposes.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E7),\"\",'6 ROPA and lawful basis'!E7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F7),\"\",'6 ROPA and lawful basis'!F7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G7),\"\",'6 ROPA and lawful basis'!G7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H7),\"\",'6 ROPA and lawful basis'!H7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I7),\"\",'6 ROPA and lawful basis'!I7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J7),\"\",'6 ROPA and lawful basis'!J7)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K7),\"\",'6 ROPA and lawful basis'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O7),\"\",'6 ROPA and lawful basis'!O7)","v":""}]
["Records of processing and lawful basis ",6.3,"The ROPA contains all the relevant requirements set out in Article 30 of the UK GDPR.","6.3.1","Ensure the ROPA includes (as a minimum):\n• Your organisation's name and contact details, whether it is a controller or a processor (and where applicable, the joint controller, their representative and the DPO);\n• the purposes of the processing;\n• a description of the categories of people and personal data;\n• the categories of recipients of personal data;\n• details of transfers to third countries, including a record of the transfer mechanism safeguards in place;\n• retention schedules; and\n• a description of the technical and organisational security measures in place.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E8),\"\",'6 ROPA and lawful basis'!E8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F8),\"\",'6 ROPA and lawful basis'!F8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G8),\"\",'6 ROPA and lawful basis'!G8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H8),\"\",'6 ROPA and lawful basis'!H8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I8),\"\",'6 ROPA and lawful basis'!I8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J8),\"\",'6 ROPA and lawful basis'!J8)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K8),\"\",'6 ROPA and lawful basis'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O8),\"\",'6 ROPA and lawful basis'!O8)","v":""}]
["Records of processing and lawful basis ",{"$f":"B153","v":6.3},"The ROPA contains all the relevant requirements set out in Article 30 of the UK GDPR.","6.3.2","Document an internal record of all processing activities carried out by any processors on behalf of your organisation.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E9),\"\",'6 ROPA and lawful basis'!E9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F9),\"\",'6 ROPA and lawful basis'!F9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G9),\"\",'6 ROPA and lawful basis'!G9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H9),\"\",'6 ROPA and lawful basis'!H9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I9),\"\",'6 ROPA and lawful basis'!I9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J9),\"\",'6 ROPA and lawful basis'!J9)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K9),\"\",'6 ROPA and lawful basis'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O9),\"\",'6 ROPA and lawful basis'!O9)","v":""}]
["Records of processing and lawful basis ",6.4,"The ROPA includes links to other relevant documentation, such as contracts or records as a matter of good practice.","6.4.1","The ROPA also includes, or links to documentation covering:\n• information required for privacy notices, such as the lawful basis for the processing and the source of the personal data;\n• records of consent;\n• controller-processor contracts;\n• the location of personal data;\n•  DPIA reports;\n• records of personal data breaches;\n• information required for processing special category data or criminal conviction and offence data under the Data Protection Act 2018 (DPA 2018); and\n• retention and erasure policy documents.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E10),\"\",'6 ROPA and lawful basis'!E10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F10),\"\",'6 ROPA and lawful basis'!F10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G10),\"\",'6 ROPA and lawful basis'!G10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H10),\"\",'6 ROPA and lawful basis'!H10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I10),\"\",'6 ROPA and lawful basis'!I10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J10),\"\",'6 ROPA and lawful basis'!J10)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K10),\"\",'6 ROPA and lawful basis'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O10),\"\",'6 ROPA and lawful basis'!O10)","v":""}]
["Records of processing and lawful basis ",6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.1","Select the most appropriate lawful basis (or bases) for each activity following a review of the processing purposes.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E11),\"\",'6 ROPA and lawful basis'!E11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F11),\"\",'6 ROPA and lawful basis'!F11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G11),\"\",'6 ROPA and lawful basis'!G11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H11),\"\",'6 ROPA and lawful basis'!H11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I11),\"\",'6 ROPA and lawful basis'!I11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J11),\"\",'6 ROPA and lawful basis'!J11)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K11),\"\",'6 ROPA and lawful basis'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O11),\"\",'6 ROPA and lawful basis'!O11)","v":""}]
["Records of processing and lawful basis ",{"$f":"B156","v":6.5},"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.2","Document the lawful basis (or bases) relied upon and the reasons why.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E12),\"\",'6 ROPA and lawful basis'!E12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F12),\"\",'6 ROPA and lawful basis'!F12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G12),\"\",'6 ROPA and lawful basis'!G12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H12),\"\",'6 ROPA and lawful basis'!H12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I12),\"\",'6 ROPA and lawful basis'!I12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J12),\"\",'6 ROPA and lawful basis'!J12)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K12),\"\",'6 ROPA and lawful basis'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O12),\"\",'6 ROPA and lawful basis'!O12)","v":""}]
["Records of processing and lawful basis ",6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.3","If your organisation processes special category or criminal offence data, identify and document a lawful basis for general processing and an additional condition for processing this type of information (or in the case of criminal offence data, identify the official authority to process).",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E13),\"\",'6 ROPA and lawful basis'!E13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F13),\"\",'6 ROPA and lawful basis'!F13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G13),\"\",'6 ROPA and lawful basis'!G13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H13),\"\",'6 ROPA and lawful basis'!H13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I13),\"\",'6 ROPA and lawful basis'!I13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J13),\"\",'6 ROPA and lawful basis'!J13)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K13),\"\",'6 ROPA and lawful basis'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O13),\"\",'6 ROPA and lawful basis'!O13)","v":""}]
["Records of processing and lawful basis ",6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.4","In the case of special category or criminal offence data, document consideration of the requirements of Article 9 or 10 of the UK GDPR and Schedule 1 of the DPA 2018 where relevant.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E14),\"\",'6 ROPA and lawful basis'!E14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F14),\"\",'6 ROPA and lawful basis'!F14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G14),\"\",'6 ROPA and lawful basis'!G14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H14),\"\",'6 ROPA and lawful basis'!H14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I14),\"\",'6 ROPA and lawful basis'!I14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J14),\"\",'6 ROPA and lawful basis'!J14)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K14),\"\",'6 ROPA and lawful basis'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O14),\"\",'6 ROPA and lawful basis'!O14)","v":""}]
["Records of processing and lawful basis ",6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.5","Where Schedule 1 requires it, have an appropriate policy document including:\n• which Schedule 1 conditions you are relying upon;\n• what procedures you have in place to ensure compliance with the data protection principle;\n• how you will treat special category or criminal offence data for retention and erasure purposes;\n• a review date; and\n• details of the person assigned responsibility for the processing.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E15),\"\",'6 ROPA and lawful basis'!E15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F15),\"\",'6 ROPA and lawful basis'!F15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G15),\"\",'6 ROPA and lawful basis'!G15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H15),\"\",'6 ROPA and lawful basis'!H15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I15),\"\",'6 ROPA and lawful basis'!I15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J15),\"\",'6 ROPA and lawful basis'!J15)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K15),\"\",'6 ROPA and lawful basis'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O15),\"\",'6 ROPA and lawful basis'!O15)","v":""}]
["Records of processing and lawful basis ",6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.6","Identify the lawful basis before starting any new processing.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E16),\"\",'6 ROPA and lawful basis'!E16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F16),\"\",'6 ROPA and lawful basis'!F16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G16),\"\",'6 ROPA and lawful basis'!G16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H16),\"\",'6 ROPA and lawful basis'!H16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I16),\"\",'6 ROPA and lawful basis'!I16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J16),\"\",'6 ROPA and lawful basis'!J16)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K16),\"\",'6 ROPA and lawful basis'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O16),\"\",'6 ROPA and lawful basis'!O16)","v":""}]
["Records of processing and lawful basis ",6.6,"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.1","Make information about the purposes of the processing, your lawful basis and relevant conditions for processing any special category or criminal offence data publicly available in your organisation's privacy notice(s).",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E17),\"\",'6 ROPA and lawful basis'!E17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F17),\"\",'6 ROPA and lawful basis'!F17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G17),\"\",'6 ROPA and lawful basis'!G17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H17),\"\",'6 ROPA and lawful basis'!H17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I17),\"\",'6 ROPA and lawful basis'!I17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J17),\"\",'6 ROPA and lawful basis'!J17)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K17),\"\",'6 ROPA and lawful basis'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O17),\"\",'6 ROPA and lawful basis'!O17)","v":""}]
["Records of processing and lawful basis ",{"$f":"B162","v":6.6},"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.2","Provide information in an easily understandable format.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E18),\"\",'6 ROPA and lawful basis'!E18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F18),\"\",'6 ROPA and lawful basis'!F18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G18),\"\",'6 ROPA and lawful basis'!G18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H18),\"\",'6 ROPA and lawful basis'!H18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I18),\"\",'6 ROPA and lawful basis'!I18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J18),\"\",'6 ROPA and lawful basis'!J18)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K18),\"\",'6 ROPA and lawful basis'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O18),\"\",'6 ROPA and lawful basis'!O18)","v":""}]
["Records of processing and lawful basis ",6.6,"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.3","If there is a genuine change in circumstances, or if your lawful basis must change due to a new and unanticipated purpose, inform people in a timely manner and record the changes.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E19),\"\",'6 ROPA and lawful basis'!E19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F19),\"\",'6 ROPA and lawful basis'!F19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G19),\"\",'6 ROPA and lawful basis'!G19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H19),\"\",'6 ROPA and lawful basis'!H19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I19),\"\",'6 ROPA and lawful basis'!I19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J19),\"\",'6 ROPA and lawful basis'!J19)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K19),\"\",'6 ROPA and lawful basis'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O19),\"\",'6 ROPA and lawful basis'!O19)","v":""}]
["Records of processing and lawful basis ",6.7,"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.1","Ensure consent requests: \n• are kept separate from other terms and conditions; \n• require a positive opt-in and do not use pre-ticked boxes; \n• are clear and specific (not a pre-condition of signing up to a service); \n• inform people how to withdraw consent in an easy way; and \n• give your organisation's name as well as the names of any third parties relying on consent.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E20),\"\",'6 ROPA and lawful basis'!E20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F20),\"\",'6 ROPA and lawful basis'!F20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G20),\"\",'6 ROPA and lawful basis'!G20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H20),\"\",'6 ROPA and lawful basis'!H20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I20),\"\",'6 ROPA and lawful basis'!I20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J20),\"\",'6 ROPA and lawful basis'!J20)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K20),\"\",'6 ROPA and lawful basis'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O20),\"\",'6 ROPA and lawful basis'!O20)","v":""}]
["Records of processing and lawful basis ",{"$f":"B165","v":6.7},"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.2","Record what a person has consented to, including what they were told and when and how they consented. Ensure the records are thorough and easy for relevant staff to access, review and withdraw if required.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E21),\"\",'6 ROPA and lawful basis'!E21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F21),\"\",'6 ROPA and lawful basis'!F21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G21),\"\",'6 ROPA and lawful basis'!G21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H21),\"\",'6 ROPA and lawful basis'!H21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I21),\"\",'6 ROPA and lawful basis'!I21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J21),\"\",'6 ROPA and lawful basis'!J21)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K21),\"\",'6 ROPA and lawful basis'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O21),\"\",'6 ROPA and lawful basis'!O21)","v":""}]
["Records of processing and lawful basis ",6.7,"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.3","Have evidence and examples of how consent is sought from people, for example online forms or notices, opt-in tick boxes or paper-based forms.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E22),\"\",'6 ROPA and lawful basis'!E22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F22),\"\",'6 ROPA and lawful basis'!F22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G22),\"\",'6 ROPA and lawful basis'!G22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H22),\"\",'6 ROPA and lawful basis'!H22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I22),\"\",'6 ROPA and lawful basis'!I22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J22),\"\",'6 ROPA and lawful basis'!J22)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K22),\"\",'6 ROPA and lawful basis'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O22),\"\",'6 ROPA and lawful basis'!O22)","v":""}]
["Records of processing and lawful basis ",6.8,"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.1","Have a procedure in place to review consents to check that the relationship, the processing and the purposes have not changed and to record any changes.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E23),\"\",'6 ROPA and lawful basis'!E23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F23),\"\",'6 ROPA and lawful basis'!F23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G23),\"\",'6 ROPA and lawful basis'!G23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H23),\"\",'6 ROPA and lawful basis'!H23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I23),\"\",'6 ROPA and lawful basis'!I23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J23),\"\",'6 ROPA and lawful basis'!J23)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K23),\"\",'6 ROPA and lawful basis'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O23),\"\",'6 ROPA and lawful basis'!O23)","v":""}]
["Records of processing and lawful basis ",{"$f":"B168","v":6.8},"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.2","Have a procedure in place to refresh consent at appropriate intervals.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E24),\"\",'6 ROPA and lawful basis'!E24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F24),\"\",'6 ROPA and lawful basis'!F24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G24),\"\",'6 ROPA and lawful basis'!G24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H24),\"\",'6 ROPA and lawful basis'!H24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I24),\"\",'6 ROPA and lawful basis'!I24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J24),\"\",'6 ROPA and lawful basis'!J24)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K24),\"\",'6 ROPA and lawful basis'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O24),\"\",'6 ROPA and lawful basis'!O24)","v":""}]
["Records of processing and lawful basis ",6.8,"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.3","Use privacy dashboards or other preference management tools to help people manage their consent.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E25),\"\",'6 ROPA and lawful basis'!E25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F25),\"\",'6 ROPA and lawful basis'!F25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G25),\"\",'6 ROPA and lawful basis'!G25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H25),\"\",'6 ROPA and lawful basis'!H25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I25),\"\",'6 ROPA and lawful basis'!I25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J25),\"\",'6 ROPA and lawful basis'!J25)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K25),\"\",'6 ROPA and lawful basis'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O25),\"\",'6 ROPA and lawful basis'!O25)","v":""}]
["Records of processing and lawful basis ",6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.1","Make reasonable efforts to check the age of those giving consent, particularly where the person is a child.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E26),\"\",'6 ROPA and lawful basis'!E26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F26),\"\",'6 ROPA and lawful basis'!F26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G26),\"\",'6 ROPA and lawful basis'!G26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H26),\"\",'6 ROPA and lawful basis'!H26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I26),\"\",'6 ROPA and lawful basis'!I26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J26),\"\",'6 ROPA and lawful basis'!J26)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K26),\"\",'6 ROPA and lawful basis'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O26),\"\",'6 ROPA and lawful basis'!O26)","v":""}]
["Records of processing and lawful basis ",{"$f":"B171","v":6.9},"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.2","Ensure you have a reasonable and effective procedure to determine whether the person in question can provide their own consent, and if not, an effective way to gain and record parental or guardian consent.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E27),\"\",'6 ROPA and lawful basis'!E27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F27),\"\",'6 ROPA and lawful basis'!F27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G27),\"\",'6 ROPA and lawful basis'!G27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H27),\"\",'6 ROPA and lawful basis'!H27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I27),\"\",'6 ROPA and lawful basis'!I27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J27),\"\",'6 ROPA and lawful basis'!J27)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K27),\"\",'6 ROPA and lawful basis'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O27),\"\",'6 ROPA and lawful basis'!O27)","v":""}]
["Records of processing and lawful basis ",6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.3","When providing online services to children, ensure there are risk-based age checking systems in place to establish age, with an appropriate level of certainty based on the risks to children's rights and freedoms.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E28),\"\",'6 ROPA and lawful basis'!E28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F28),\"\",'6 ROPA and lawful basis'!F28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G28),\"\",'6 ROPA and lawful basis'!G28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H28),\"\",'6 ROPA and lawful basis'!H28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I28),\"\",'6 ROPA and lawful basis'!I28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J28),\"\",'6 ROPA and lawful basis'!J28)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K28),\"\",'6 ROPA and lawful basis'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O28),\"\",'6 ROPA and lawful basis'!O28)","v":""}]
["Records of processing and lawful basis ",6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.4","When providing online services to children, if the child is under 13, have records of parental or guardian consent which are regularly reviewed, and make reasonable efforts to verify that the person giving consent has parental responsibility. Give particular consideration when a child reaches the age of 13 and is able to provide their own consent.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E29),\"\",'6 ROPA and lawful basis'!E29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F29),\"\",'6 ROPA and lawful basis'!F29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G29),\"\",'6 ROPA and lawful basis'!G29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H29),\"\",'6 ROPA and lawful basis'!H29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I29),\"\",'6 ROPA and lawful basis'!I29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J29),\"\",'6 ROPA and lawful basis'!J29)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K29),\"\",'6 ROPA and lawful basis'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O29),\"\",'6 ROPA and lawful basis'!O29)","v":""}]
["Records of processing and lawful basis ",6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.1","Ensure the LIA identifies the legitimate interest, the benefits of the processing and whether it is necessary.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E30),\"\",'6 ROPA and lawful basis'!E30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F30),\"\",'6 ROPA and lawful basis'!F30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G30),\"\",'6 ROPA and lawful basis'!G30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H30),\"\",'6 ROPA and lawful basis'!H30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I30),\"\",'6 ROPA and lawful basis'!I30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J30),\"\",'6 ROPA and lawful basis'!J30)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K30),\"\",'6 ROPA and lawful basis'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O30),\"\",'6 ROPA and lawful basis'!O30)","v":""}]
[{"$f":"A175","v":"Records of processing and lawful basis "},6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.2","Include a 'balancing test' to show how your organisation determines that its legitimate interests override the person's interests and consider the following issues:\n• not using people's data in intrusive ways or in ways which could cause harm, unless there is a very good reason;\n• protecting the interests of vulnerable groups such as people with learning disabilities or children;\n• whether you could introduce safeguards to reduce any potentially negative impact;\n• whether you could offer an opt-out; and\n• whether you require a DPIA.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E31),\"\",'6 ROPA and lawful basis'!E31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F31),\"\",'6 ROPA and lawful basis'!F31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G31),\"\",'6 ROPA and lawful basis'!G31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H31),\"\",'6 ROPA and lawful basis'!H31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I31),\"\",'6 ROPA and lawful basis'!I31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J31),\"\",'6 ROPA and lawful basis'!J31)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K31),\"\",'6 ROPA and lawful basis'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O31),\"\",'6 ROPA and lawful basis'!O31)","v":""}]
["Records of processing and lawful basis ",6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.3","Clearly document the decision and the assessment.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E32),\"\",'6 ROPA and lawful basis'!E32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F32),\"\",'6 ROPA and lawful basis'!F32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G32),\"\",'6 ROPA and lawful basis'!G32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H32),\"\",'6 ROPA and lawful basis'!H32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I32),\"\",'6 ROPA and lawful basis'!I32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J32),\"\",'6 ROPA and lawful basis'!J32)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K32),\"\",'6 ROPA and lawful basis'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O32),\"\",'6 ROPA and lawful basis'!O32)","v":""}]
["Records of processing and lawful basis ",6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.4","Complete the LIA prior to the start of the processing.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E33),\"\",'6 ROPA and lawful basis'!E33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F33),\"\",'6 ROPA and lawful basis'!F33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G33),\"\",'6 ROPA and lawful basis'!G33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H33),\"\",'6 ROPA and lawful basis'!H33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I33),\"\",'6 ROPA and lawful basis'!I33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J33),\"\",'6 ROPA and lawful basis'!J33)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K33),\"\",'6 ROPA and lawful basis'!K33)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O33),\"\",'6 ROPA and lawful basis'!O33)","v":""}]
["Records of processing and lawful basis ",6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.5","Keep the LIA under review and refresh it if changes affect the outcome.",{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!E34),\"\",'6 ROPA and lawful basis'!E34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!F34),\"\",'6 ROPA and lawful basis'!F34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!G34),\"\",'6 ROPA and lawful basis'!G34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!H34),\"\",'6 ROPA and lawful basis'!H34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!I34),\"\",'6 ROPA and lawful basis'!I34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!J34),\"\",'6 ROPA and lawful basis'!J34)","v":""},{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!K34),\"\",'6 ROPA and lawful basis'!K34)","v":""},null,null,null,{"$f":"IF(ISBLANK('6 ROPA and lawful basis'!O34),\"\",'6 ROPA and lawful basis'!O34)","v":""}]
["Contracts and data sharing",7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.1","Implement a review process, through a DPIA or a similar exercise, to assess the legality, benefits and risks of the data sharing.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E2),\"\",'7. Contracts and data sharing'!E2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F2),\"\",'7. Contracts and data sharing'!F2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G2),\"\",'7. Contracts and data sharing'!G2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H2),\"\",'7. Contracts and data sharing'!H2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I2),\"\",'7. Contracts and data sharing'!I2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J2),\"\",'7. Contracts and data sharing'!J2)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K2),\"\",'7. Contracts and data sharing'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O2),\"\",'7. Contracts and data sharing'!O2)","v":""}]
[{"$f":"A180","v":"Contracts and data sharing"},{"$f":"B180","v":7.1},"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.2","Document all sharing decisions for audit, monitoring and investigation purposes and regularly review them.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E3),\"\",'7. Contracts and data sharing'!E3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F3),\"\",'7. Contracts and data sharing'!F3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G3),\"\",'7. Contracts and data sharing'!G3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H3),\"\",'7. Contracts and data sharing'!H3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I3),\"\",'7. Contracts and data sharing'!I3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J3),\"\",'7. Contracts and data sharing'!J3)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K3),\"\",'7. Contracts and data sharing'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O3),\"\",'7. Contracts and data sharing'!O3)","v":""}]
["Contracts and data sharing",7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.3","Have clear policies, procedures and guidance about data sharing, including who has the authority to make decisions about systematic data sharing or one-off disclosures, and when it is appropriate to do so.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E4),\"\",'7. Contracts and data sharing'!E4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F4),\"\",'7. Contracts and data sharing'!F4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G4),\"\",'7. Contracts and data sharing'!G4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H4),\"\",'7. Contracts and data sharing'!H4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I4),\"\",'7. Contracts and data sharing'!I4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J4),\"\",'7. Contracts and data sharing'!J4)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K4),\"\",'7. Contracts and data sharing'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O4),\"\",'7. Contracts and data sharing'!O4)","v":""}]
["Contracts and data sharing",7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.4","Train all staff likely to make decisions about data sharing, and makes them aware of their responsibilities. Refresh this training appropriately.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E5),\"\",'7. Contracts and data sharing'!E5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F5),\"\",'7. Contracts and data sharing'!F5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G5),\"\",'7. Contracts and data sharing'!G5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H5),\"\",'7. Contracts and data sharing'!H5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I5),\"\",'7. Contracts and data sharing'!I5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J5),\"\",'7. Contracts and data sharing'!J5)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K5),\"\",'7. Contracts and data sharing'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O5),\"\",'7. Contracts and data sharing'!O5)","v":""}]
["Contracts and data sharing",7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.1","Agree data sharing agreements with all the relevant parties and ensure senior management sign them off.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E6),\"\",'7. Contracts and data sharing'!E6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F6),\"\",'7. Contracts and data sharing'!F6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G6),\"\",'7. Contracts and data sharing'!G6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H6),\"\",'7. Contracts and data sharing'!H6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I6),\"\",'7. Contracts and data sharing'!I6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J6),\"\",'7. Contracts and data sharing'!J6)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K6),\"\",'7. Contracts and data sharing'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O6),\"\",'7. Contracts and data sharing'!O6)","v":""}]
["Contracts and data sharing",{"$f":"B184","v":7.2},"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.2","Ensure the data sharing agreement includes details about: \n• the parties' roles;\n• the purpose of the data sharing; \n• what is going to happen to the data at each stage; and \n• sets standards (with a high privacy default for children).",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E7),\"\",'7. Contracts and data sharing'!E7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F7),\"\",'7. Contracts and data sharing'!F7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G7),\"\",'7. Contracts and data sharing'!G7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H7),\"\",'7. Contracts and data sharing'!H7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I7),\"\",'7. Contracts and data sharing'!I7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J7),\"\",'7. Contracts and data sharing'!J7)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K7),\"\",'7. Contracts and data sharing'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O7),\"\",'7. Contracts and data sharing'!O7)","v":""}]
["Contracts and data sharing",7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.3","Where necessary, implement procedures and guidance covering each organisation’s day-to-day operations to support the agreements.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E8),\"\",'7. Contracts and data sharing'!E8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F8),\"\",'7. Contracts and data sharing'!F8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G8),\"\",'7. Contracts and data sharing'!G8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H8),\"\",'7. Contracts and data sharing'!H8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I8),\"\",'7. Contracts and data sharing'!I8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J8),\"\",'7. Contracts and data sharing'!J8)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K8),\"\",'7. Contracts and data sharing'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O8),\"\",'7. Contracts and data sharing'!O8)","v":""}]
["Contracts and data sharing",7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.4","If your organisation is acting as a joint controller (within the meaning of Article 26 of the UK GDPR), set out responsibilities under an arrangement or a data sharing agreement and provide appropriate privacy information to people.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E9),\"\",'7. Contracts and data sharing'!E9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F9),\"\",'7. Contracts and data sharing'!F9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G9),\"\",'7. Contracts and data sharing'!G9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H9),\"\",'7. Contracts and data sharing'!H9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I9),\"\",'7. Contracts and data sharing'!I9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J9),\"\",'7. Contracts and data sharing'!J9)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K9),\"\",'7. Contracts and data sharing'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O9),\"\",'7. Contracts and data sharing'!O9)","v":""}]
["Contracts and data sharing",7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.5","Have a regular review process to make sure that the information remains accurate and up to date, and to examine how the agreement is working.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E10),\"\",'7. Contracts and data sharing'!E10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F10),\"\",'7. Contracts and data sharing'!F10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G10),\"\",'7. Contracts and data sharing'!G10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H10),\"\",'7. Contracts and data sharing'!H10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I10),\"\",'7. Contracts and data sharing'!I10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J10),\"\",'7. Contracts and data sharing'!J10)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K10),\"\",'7. Contracts and data sharing'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O10),\"\",'7. Contracts and data sharing'!O10)","v":""}]
["Contracts and data sharing",7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.6","Keep a central log of the current sharing agreements",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E11),\"\",'7. Contracts and data sharing'!E11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F11),\"\",'7. Contracts and data sharing'!F11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G11),\"\",'7. Contracts and data sharing'!G11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H11),\"\",'7. Contracts and data sharing'!H11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I11),\"\",'7. Contracts and data sharing'!I11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J11),\"\",'7. Contracts and data sharing'!J11)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K11),\"\",'7. Contracts and data sharing'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O11),\"\",'7. Contracts and data sharing'!O11)","v":""}]
["Contracts and data sharing",7.3,"There are procedures in place to make sure that restricted transfers are made appropriately.","7.3.1","Consider whether the restricted transfer is covered by an adequacy decision or by 'appropriate safeguards' listed in data protection law, such as contracts incorporating standard contractual data protection clauses adopted by the Commission or Binding Corporate Rules (BCRs).",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E12),\"\",'7. Contracts and data sharing'!E12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F12),\"\",'7. Contracts and data sharing'!F12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G12),\"\",'7. Contracts and data sharing'!G12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H12),\"\",'7. Contracts and data sharing'!H12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I12),\"\",'7. Contracts and data sharing'!I12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J12),\"\",'7. Contracts and data sharing'!J12)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K12),\"\",'7. Contracts and data sharing'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O12),\"\",'7. Contracts and data sharing'!O12)","v":""}]
["Contracts and data sharing",{"$f":"B190","v":7.3},"There are procedures in place to make sure that restricted transfers are made appropriately.","7.3.2","If a restricted transfer is not covered by an adequacy decision nor an appropriate safeguard, consider whether it is covered by an exemption set out in Article 49 of the UK GDPR.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E13),\"\",'7. Contracts and data sharing'!E13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F13),\"\",'7. Contracts and data sharing'!F13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G13),\"\",'7. Contracts and data sharing'!G13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H13),\"\",'7. Contracts and data sharing'!H13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I13),\"\",'7. Contracts and data sharing'!I13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J13),\"\",'7. Contracts and data sharing'!J13)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K13),\"\",'7. Contracts and data sharing'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O13),\"\",'7. Contracts and data sharing'!O13)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.1","Ensure there are written contracts with all processors.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E14),\"\",'7. Contracts and data sharing'!E14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F14),\"\",'7. Contracts and data sharing'!F14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G14),\"\",'7. Contracts and data sharing'!G14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H14),\"\",'7. Contracts and data sharing'!H14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I14),\"\",'7. Contracts and data sharing'!I14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J14),\"\",'7. Contracts and data sharing'!J14)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K14),\"\",'7. Contracts and data sharing'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O14),\"\",'7. Contracts and data sharing'!O14)","v":""}]
["Contracts and data sharing",{"$f":"B192","v":7.4},"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.2","If using a processor, assess the risk to people and make sure that these risks are mitigated effectively.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E15),\"\",'7. Contracts and data sharing'!E15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F15),\"\",'7. Contracts and data sharing'!F15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G15),\"\",'7. Contracts and data sharing'!G15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H15),\"\",'7. Contracts and data sharing'!H15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I15),\"\",'7. Contracts and data sharing'!I15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J15),\"\",'7. Contracts and data sharing'!J15)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K15),\"\",'7. Contracts and data sharing'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O15),\"\",'7. Contracts and data sharing'!O15)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.3","Ensure an appropriate level of management approves the contracts and both parties sign. The level of management required for approval should be proportionate to the value and risk of the contract.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E16),\"\",'7. Contracts and data sharing'!E16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F16),\"\",'7. Contracts and data sharing'!F16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G16),\"\",'7. Contracts and data sharing'!G16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H16),\"\",'7. Contracts and data sharing'!H16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I16),\"\",'7. Contracts and data sharing'!I16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J16),\"\",'7. Contracts and data sharing'!J16)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K16),\"\",'7. Contracts and data sharing'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O16),\"\",'7. Contracts and data sharing'!O16)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.4","Ensure each contract (or other legal act) sets out details of the processing, including the:\n•  subject matter of the processing;\n•  duration of the processing;\n•  nature and purpose of the processing;\n•  type of personal information involved;\n•  categories of people; and\n•  controller’s obligations and rights, in accordance with the list set out in Article 28(3) of the UK GDPR.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E17),\"\",'7. Contracts and data sharing'!E17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F17),\"\",'7. Contracts and data sharing'!F17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G17),\"\",'7. Contracts and data sharing'!G17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H17),\"\",'7. Contracts and data sharing'!H17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I17),\"\",'7. Contracts and data sharing'!I17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J17),\"\",'7. Contracts and data sharing'!J17)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K17),\"\",'7. Contracts and data sharing'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O17),\"\",'7. Contracts and data sharing'!O17)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.5","Keep a record or log of all current processor contracts, and update it when processors change.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E18),\"\",'7. Contracts and data sharing'!E18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F18),\"\",'7. Contracts and data sharing'!F18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G18),\"\",'7. Contracts and data sharing'!G18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H18),\"\",'7. Contracts and data sharing'!H18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I18),\"\",'7. Contracts and data sharing'!I18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J18),\"\",'7. Contracts and data sharing'!J18)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K18),\"\",'7. Contracts and data sharing'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O18),\"\",'7. Contracts and data sharing'!O18)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.6","Review contracts periodically to make sure they remain up to date.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E19),\"\",'7. Contracts and data sharing'!E19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F19),\"\",'7. Contracts and data sharing'!F19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G19),\"\",'7. Contracts and data sharing'!G19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H19),\"\",'7. Contracts and data sharing'!H19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I19),\"\",'7. Contracts and data sharing'!I19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J19),\"\",'7. Contracts and data sharing'!J19)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K19),\"\",'7. Contracts and data sharing'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O19),\"\",'7. Contracts and data sharing'!O19)","v":""}]
["Contracts and data sharing",7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.7","If a processor uses a sub-processor to help with the processing it is doing on your behalf, ensure they have written authorisation from your organisation and a written contract with that sub-processor.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E20),\"\",'7. Contracts and data sharing'!E20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F20),\"\",'7. Contracts and data sharing'!F20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G20),\"\",'7. Contracts and data sharing'!G20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H20),\"\",'7. Contracts and data sharing'!H20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I20),\"\",'7. Contracts and data sharing'!I20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J20),\"\",'7. Contracts and data sharing'!J20)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K20),\"\",'7. Contracts and data sharing'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O20),\"\",'7. Contracts and data sharing'!O20)","v":""}]
["Contracts and data sharing",7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.1","Ensure the contract or other legal act includes terms or clauses stating that the processor must:\n• only act on the controller’s documented instructions, unless required by law to act without such instructions;\n• ensure that people processing the data are subject to a duty of confidence;\n• help the controller respond to requests from people to exercise their rights; and\n• submit to audits and inspections.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E21),\"\",'7. Contracts and data sharing'!E21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F21),\"\",'7. Contracts and data sharing'!F21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G21),\"\",'7. Contracts and data sharing'!G21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H21),\"\",'7. Contracts and data sharing'!H21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I21),\"\",'7. Contracts and data sharing'!I21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J21),\"\",'7. Contracts and data sharing'!J21)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K21),\"\",'7. Contracts and data sharing'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O21),\"\",'7. Contracts and data sharing'!O21)","v":""}]
["Contracts and data sharing",{"$f":"B199","v":7.5},"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.2","Contracts include the technical and organisational security measures the processor will adopt (including encryption, pseudonymisation, resilience of processing systems and backing up personal data in order to be able to reinstate the system).",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E22),\"\",'7. Contracts and data sharing'!E22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F22),\"\",'7. Contracts and data sharing'!F22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G22),\"\",'7. Contracts and data sharing'!G22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H22),\"\",'7. Contracts and data sharing'!H22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I22),\"\",'7. Contracts and data sharing'!I22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J22),\"\",'7. Contracts and data sharing'!J22)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K22),\"\",'7. Contracts and data sharing'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O22),\"\",'7. Contracts and data sharing'!O22)","v":""}]
["Contracts and data sharing",7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.3","The contract inlcudes clauses to make sure that the processor either deletes or returns all personal data to the controller at the end of the contract. The processor must also delete existing personal data unless the law requires its storage.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E23),\"\",'7. Contracts and data sharing'!E23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F23),\"\",'7. Contracts and data sharing'!F23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G23),\"\",'7. Contracts and data sharing'!G23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H23),\"\",'7. Contracts and data sharing'!H23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I23),\"\",'7. Contracts and data sharing'!I23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J23),\"\",'7. Contracts and data sharing'!J23)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K23),\"\",'7. Contracts and data sharing'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O23),\"\",'7. Contracts and data sharing'!O23)","v":""}]
["Contracts and data sharing",7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.4","Clauses are included to make sure that the processor assists the controller in meeting its UK GDPR obligations regarding the security of processing, the notification of personal data breaches and DPIAs. ",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E24),\"\",'7. Contracts and data sharing'!E24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F24),\"\",'7. Contracts and data sharing'!F24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G24),\"\",'7. Contracts and data sharing'!G24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H24),\"\",'7. Contracts and data sharing'!H24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I24),\"\",'7. Contracts and data sharing'!I24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J24),\"\",'7. Contracts and data sharing'!J24)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K24),\"\",'7. Contracts and data sharing'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O24),\"\",'7. Contracts and data sharing'!O24)","v":""}]
["Contracts and data sharing",7.6,"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.1","Build in due diligence checks into the procurement process that are proportionate to the risk of the processing before you agree a contract with a processor.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E25),\"\",'7. Contracts and data sharing'!E25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F25),\"\",'7. Contracts and data sharing'!F25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G25),\"\",'7. Contracts and data sharing'!G25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H25),\"\",'7. Contracts and data sharing'!H25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I25),\"\",'7. Contracts and data sharing'!I25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J25),\"\",'7. Contracts and data sharing'!J25)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K25),\"\",'7. Contracts and data sharing'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O25),\"\",'7. Contracts and data sharing'!O25)","v":""}]
["Contracts and data sharing",{"$f":"B203","v":7.6},"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.2","Ensure the due diligence process includes data security checks, eg site visits, system testing and audit requests.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E26),\"\",'7. Contracts and data sharing'!E26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F26),\"\",'7. Contracts and data sharing'!F26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G26),\"\",'7. Contracts and data sharing'!G26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H26),\"\",'7. Contracts and data sharing'!H26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I26),\"\",'7. Contracts and data sharing'!I26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J26),\"\",'7. Contracts and data sharing'!J26)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K26),\"\",'7. Contracts and data sharing'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O26),\"\",'7. Contracts and data sharing'!O26)","v":""}]
["Contracts and data sharing",7.6,"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.3","Ensure the due diligence process includes checks to confirm a potential processor will protect people’s rights.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E27),\"\",'7. Contracts and data sharing'!E27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F27),\"\",'7. Contracts and data sharing'!F27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G27),\"\",'7. Contracts and data sharing'!G27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H27),\"\",'7. Contracts and data sharing'!H27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I27),\"\",'7. Contracts and data sharing'!I27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J27),\"\",'7. Contracts and data sharing'!J27)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K27),\"\",'7. Contracts and data sharing'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O27),\"\",'7. Contracts and data sharing'!O27)","v":""}]
["Contracts and data sharing",7.7,"There is a review of data processors’ compliance with their contracts.","7.7.1","Ensure contracts include clauses to allow your organisation to conduct audits or checks, to confirm the processor is complying with all contractual terms and conditions.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E28),\"\",'7. Contracts and data sharing'!E28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F28),\"\",'7. Contracts and data sharing'!F28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G28),\"\",'7. Contracts and data sharing'!G28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H28),\"\",'7. Contracts and data sharing'!H28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I28),\"\",'7. Contracts and data sharing'!I28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J28),\"\",'7. Contracts and data sharing'!J28)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K28),\"\",'7. Contracts and data sharing'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O28),\"\",'7. Contracts and data sharing'!O28)","v":""}]
["Contracts and data sharing",{"$f":"B206","v":7.7},"There is a review of data processors’ compliance with their contracts.","7.7.2","Carry out routine compliance checks, proportionate to the processing risks, to test that processors are complying with contractual agreements.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E29),\"\",'7. Contracts and data sharing'!E29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F29),\"\",'7. Contracts and data sharing'!F29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G29),\"\",'7. Contracts and data sharing'!G29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H29),\"\",'7. Contracts and data sharing'!H29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I29),\"\",'7. Contracts and data sharing'!I29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J29),\"\",'7. Contracts and data sharing'!J29)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K29),\"\",'7. Contracts and data sharing'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O29),\"\",'7. Contracts and data sharing'!O29)","v":""}]
["Contracts and data sharing",7.8,"There is evidence that ‘data protection by design’ is considered when selecting services and products to use in data processing activities.","7.8.1","When third parties supply products or services to process personal information, choose suppliers that design their products or services with data protection in mind.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E30),\"\",'7. Contracts and data sharing'!E30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F30),\"\",'7. Contracts and data sharing'!F30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G30),\"\",'7. Contracts and data sharing'!G30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H30),\"\",'7. Contracts and data sharing'!H30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I30),\"\",'7. Contracts and data sharing'!I30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J30),\"\",'7. Contracts and data sharing'!J30)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K30),\"\",'7. Contracts and data sharing'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O30),\"\",'7. Contracts and data sharing'!O30)","v":""}]
["Contracts and data sharing",7.9,"There are proactive steps taken to only share necessary personal information with processors or other third parties.","7.9.1","Only share the personal information necessary to achieve your specific purpose.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E31),\"\",'7. Contracts and data sharing'!E31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F31),\"\",'7. Contracts and data sharing'!F31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G31),\"\",'7. Contracts and data sharing'!G31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H31),\"\",'7. Contracts and data sharing'!H31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I31),\"\",'7. Contracts and data sharing'!I31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J31),\"\",'7. Contracts and data sharing'!J31)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K31),\"\",'7. Contracts and data sharing'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O31),\"\",'7. Contracts and data sharing'!O31)","v":""}]
[{"$f":"A209","v":"Contracts and data sharing"},7.9,"There are proactive steps taken to only share necessary personal information with processors or other third parties.","7.9.2","When information is shared, ensure it is pseudonymised or minimised wherever possible. Consider anonymisation so that the information is no longer personal information.",{"$f":"IF(ISBLANK('7. Contracts and data sharing'!E32),\"\",'7. Contracts and data sharing'!E32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!F32),\"\",'7. Contracts and data sharing'!F32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!G32),\"\",'7. Contracts and data sharing'!G32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!H32),\"\",'7. Contracts and data sharing'!H32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!I32),\"\",'7. Contracts and data sharing'!I32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!J32),\"\",'7. Contracts and data sharing'!J32)","v":""},{"$f":"IF(ISBLANK('7. Contracts and data sharing'!K32),\"\",'7. Contracts and data sharing'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('7. Contracts and data sharing'!O32),\"\",'7. Contracts and data sharing'!O32)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.1","Set out how your organisation and its data processors manage information risk in an information risk policy (either a separate document or part of a wider corporate risk policy), and decide how you monitor compliance with the information risk policy.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E2),\"\",'8. Risks and DPIAs'!E2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F2),\"\",'8. Risks and DPIAs'!F2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G2),\"\",'8. Risks and DPIAs'!G2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H2),\"\",'8. Risks and DPIAs'!H2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I2),\"\",'8. Risks and DPIAs'!I2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J2),\"\",'8. Risks and DPIAs'!J2)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K2),\"\",'8. Risks and DPIAs'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O2),\"\",'8. Risks and DPIAs'!O2)","v":""}]
[{"$f":"A211","v":"Risks and Data Protection Impact Assessments."},{"$f":"B211","v":8.1},"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.2","Have a process to help staff report and escalate information governance or data protection concerns and risks to a central point, for example staff forums.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E3),\"\",'8. Risks and DPIAs'!E3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F3),\"\",'8. Risks and DPIAs'!F3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G3),\"\",'8. Risks and DPIAs'!G3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H3),\"\",'8. Risks and DPIAs'!H3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I3),\"\",'8. Risks and DPIAs'!I3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J3),\"\",'8. Risks and DPIAs'!J3)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K3),\"\",'8. Risks and DPIAs'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O3),\"\",'8. Risks and DPIAs'!O3)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.3","Identify and manage information risks in an appropriate risk register, which includes clear links between corporate and departmental risk registers and the risk assessment of information assets.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E4),\"\",'8. Risks and DPIAs'!E4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F4),\"\",'8. Risks and DPIAs'!F4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G4),\"\",'8. Risks and DPIAs'!G4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H4),\"\",'8. Risks and DPIAs'!H4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I4),\"\",'8. Risks and DPIAs'!I4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J4),\"\",'8. Risks and DPIAs'!J4)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K4),\"\",'8. Risks and DPIAs'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O4),\"\",'8. Risks and DPIAs'!O4)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.4","Have formal procedures to identify, record and manage risks associated with information assets in an information asset register.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E5),\"\",'8. Risks and DPIAs'!E5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F5),\"\",'8. Risks and DPIAs'!F5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G5),\"\",'8. Risks and DPIAs'!G5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H5),\"\",'8. Risks and DPIAs'!H5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I5),\"\",'8. Risks and DPIAs'!I5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J5),\"\",'8. Risks and DPIAs'!J5)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K5),\"\",'8. Risks and DPIAs'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O5),\"\",'8. Risks and DPIAs'!O5)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.5","If you identify information risks, have appropriate action plans, progress reports and consider the lessons learnt to avoid future risk.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E6),\"\",'8. Risks and DPIAs'!E6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F6),\"\",'8. Risks and DPIAs'!F6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G6),\"\",'8. Risks and DPIAs'!G6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H6),\"\",'8. Risks and DPIAs'!H6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I6),\"\",'8. Risks and DPIAs'!I6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J6),\"\",'8. Risks and DPIAs'!J6)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K6),\"\",'8. Risks and DPIAs'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O6),\"\",'8. Risks and DPIAs'!O6)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.6","Put measures in place to mitigate the risks identified within risk categories, and test these regularly to make sure that they remain effective.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E7),\"\",'8. Risks and DPIAs'!E7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F7),\"\",'8. Risks and DPIAs'!F7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G7),\"\",'8. Risks and DPIAs'!G7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H7),\"\",'8. Risks and DPIAs'!H7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I7),\"\",'8. Risks and DPIAs'!I7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J7),\"\",'8. Risks and DPIAs'!J7)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K7),\"\",'8. Risks and DPIAs'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O7),\"\",'8. Risks and DPIAs'!O7)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1999999999999993,"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.1","Reference DPIA requirements in all risk, project and change management policies and procedures, with links to DPIA policies and procedures.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E8),\"\",'8. Risks and DPIAs'!E8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F8),\"\",'8. Risks and DPIAs'!F8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G8),\"\",'8. Risks and DPIAs'!G8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H8),\"\",'8. Risks and DPIAs'!H8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I8),\"\",'8. Risks and DPIAs'!I8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J8),\"\",'8. Risks and DPIAs'!J8)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K8),\"\",'8. Risks and DPIAs'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O8),\"\",'8. Risks and DPIAs'!O8)","v":""}]
["Risks and Data Protection Impact Assessments.",{"$f":"B217","v":8.1999999999999993},"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.2","Ensure procedures state that, if required, a DPIA should begin at the project's outset, before processing starts, and that the DPIA must run alongside the planning and development process.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E9),\"\",'8. Risks and DPIAs'!E9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F9),\"\",'8. Risks and DPIAs'!F9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G9),\"\",'8. Risks and DPIAs'!G9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H9),\"\",'8. Risks and DPIAs'!H9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I9),\"\",'8. Risks and DPIAs'!I9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J9),\"\",'8. Risks and DPIAs'!J9)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K9),\"\",'8. Risks and DPIAs'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O9),\"\",'8. Risks and DPIAs'!O9)","v":""}]
["Risks and Data Protection Impact Assessments.",8.1999999999999993,"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.3","Anticipate risks and privacy-invasive events before they occur, making sure that at the initial design phase of any system, product or process and throughout, you consider the: \n• intended processing activities;\n• risks that these may pose to the rights and freedoms of people; and\n• possible measures available to mitigate the risks.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E10),\"\",'8. Risks and DPIAs'!E10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F10),\"\",'8. Risks and DPIAs'!F10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G10),\"\",'8. Risks and DPIAs'!G10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H10),\"\",'8. Risks and DPIAs'!H10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I10),\"\",'8. Risks and DPIAs'!I10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J10),\"\",'8. Risks and DPIAs'!J10)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K10),\"\",'8. Risks and DPIAs'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O10),\"\",'8. Risks and DPIAs'!O10)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.1","Have a DPIA policy which includes:\n•  clear procedures to decide whether you conduct a DPIA; \n•  what the DPIA should cover;\n•   who will authorise it; and\n•  how you will incorporate it into the overall planning.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E11),\"\",'8. Risks and DPIAs'!E11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F11),\"\",'8. Risks and DPIAs'!F11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G11),\"\",'8. Risks and DPIAs'!G11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H11),\"\",'8. Risks and DPIAs'!H11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I11),\"\",'8. Risks and DPIAs'!I11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J11),\"\",'8. Risks and DPIAs'!J11)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K11),\"\",'8. Risks and DPIAs'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O11),\"\",'8. Risks and DPIAs'!O11)","v":""}]
["Risks and Data Protection Impact Assessments.",{"$f":"B220","v":8.3000000000000007},"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.2","Have a screening checklist to consider if you need a DPIA, including all the relevant considerations on the scope, type and manner of the proposed processing.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E12),\"\",'8. Risks and DPIAs'!E12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F12),\"\",'8. Risks and DPIAs'!F12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G12),\"\",'8. Risks and DPIAs'!G12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H12),\"\",'8. Risks and DPIAs'!H12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I12),\"\",'8. Risks and DPIAs'!I12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J12),\"\",'8. Risks and DPIAs'!J12)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K12),\"\",'8. Risks and DPIAs'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O12),\"\",'8. Risks and DPIAs'!O12)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.3","If the screening checklist indicates that you do not need a DPIA, document this.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E13),\"\",'8. Risks and DPIAs'!E13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F13),\"\",'8. Risks and DPIAs'!F13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G13),\"\",'8. Risks and DPIAs'!G13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H13),\"\",'8. Risks and DPIAs'!H13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I13),\"\",'8. Risks and DPIAs'!I13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J13),\"\",'8. Risks and DPIAs'!J13)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K13),\"\",'8. Risks and DPIAs'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O13),\"\",'8. Risks and DPIAs'!O13)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.4","Ensure your procedure includes the requirement to seek advice from the DPO and other internal staff as appropriate.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E14),\"\",'8. Risks and DPIAs'!E14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F14),\"\",'8. Risks and DPIAs'!F14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G14),\"\",'8. Risks and DPIAs'!G14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H14),\"\",'8. Risks and DPIAs'!H14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I14),\"\",'8. Risks and DPIAs'!I14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J14),\"\",'8. Risks and DPIAs'!J14)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K14),\"\",'8. Risks and DPIAs'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O14),\"\",'8. Risks and DPIAs'!O14)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.5","Ensure your procedure includes consultation with controllers,  processors, people, their representatives and any other relevant stakeholders as appropriate.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E15),\"\",'8. Risks and DPIAs'!E15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F15),\"\",'8. Risks and DPIAs'!F15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G15),\"\",'8. Risks and DPIAs'!G15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H15),\"\",'8. Risks and DPIAs'!H15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I15),\"\",'8. Risks and DPIAs'!I15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J15),\"\",'8. Risks and DPIAs'!J15)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K15),\"\",'8. Risks and DPIAs'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O15),\"\",'8. Risks and DPIAs'!O15)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.6","Include the need to consider a DPIA at the early stages of any plan involving personal information in your training and, where relevant, train staff in how to carry out a DPIA.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E16),\"\",'8. Risks and DPIAs'!E16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F16),\"\",'8. Risks and DPIAs'!F16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G16),\"\",'8. Risks and DPIAs'!G16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H16),\"\",'8. Risks and DPIAs'!H16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I16),\"\",'8. Risks and DPIAs'!I16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J16),\"\",'8. Risks and DPIAs'!J16)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K16),\"\",'8. Risks and DPIAs'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O16),\"\",'8. Risks and DPIAs'!O16)","v":""}]
["Risks and Data Protection Impact Assessments.",8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.7","Assign responsibility for completing DPIAs to a member of staff, who has enough authority over a project to effect change, eg a project lead or manager.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E17),\"\",'8. Risks and DPIAs'!E17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F17),\"\",'8. Risks and DPIAs'!F17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G17),\"\",'8. Risks and DPIAs'!G17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H17),\"\",'8. Risks and DPIAs'!H17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I17),\"\",'8. Risks and DPIAs'!I17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J17),\"\",'8. Risks and DPIAs'!J17)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K17),\"\",'8. Risks and DPIAs'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O17),\"\",'8. Risks and DPIAs'!O17)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.1","Implement a standard, well-structured DPIA template which is written in plain English.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E18),\"\",'8. Risks and DPIAs'!E18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F18),\"\",'8. Risks and DPIAs'!F18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G18),\"\",'8. Risks and DPIAs'!G18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H18),\"\",'8. Risks and DPIAs'!H18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I18),\"\",'8. Risks and DPIAs'!I18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J18),\"\",'8. Risks and DPIAs'!J18)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K18),\"\",'8. Risks and DPIAs'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O18),\"\",'8. Risks and DPIAs'!O18)","v":""}]
["Risks and Data Protection Impact Assessments.",{"$f":"B227","v":8.4},"DPIAs always include the appropriate information and are comprehensively documented.","8.4.2","Ensure DPIAs:\n•  include the nature, scope, context and purposes of the processing;\n•  assess necessity, proportionality and compliance measures;\n•  identify and assess risks to people; and \n•  identify any additional measures to mitigate those risks.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E19),\"\",'8. Risks and DPIAs'!E19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F19),\"\",'8. Risks and DPIAs'!F19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G19),\"\",'8. Risks and DPIAs'!G19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H19),\"\",'8. Risks and DPIAs'!H19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I19),\"\",'8. Risks and DPIAs'!I19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J19),\"\",'8. Risks and DPIAs'!J19)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K19),\"\",'8. Risks and DPIAs'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O19),\"\",'8. Risks and DPIAs'!O19)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.3","Ensure DPIAs clearly set out the relationships and data flows between controllers, processors, people and systems.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E20),\"\",'8. Risks and DPIAs'!E20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F20),\"\",'8. Risks and DPIAs'!F20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G20),\"\",'8. Risks and DPIAs'!G20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H20),\"\",'8. Risks and DPIAs'!H20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I20),\"\",'8. Risks and DPIAs'!I20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J20),\"\",'8. Risks and DPIAs'!J20)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K20),\"\",'8. Risks and DPIAs'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O20),\"\",'8. Risks and DPIAs'!O20)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.4","Ensure DPIAs identify measures that eliminate, mitigate or reduce high risks.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E21),\"\",'8. Risks and DPIAs'!E21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F21),\"\",'8. Risks and DPIAs'!F21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G21),\"\",'8. Risks and DPIAs'!G21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H21),\"\",'8. Risks and DPIAs'!H21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I21),\"\",'8. Risks and DPIAs'!I21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J21),\"\",'8. Risks and DPIAs'!J21)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K21),\"\",'8. Risks and DPIAs'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O21),\"\",'8. Risks and DPIAs'!O21)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.5","Have a documented process, with appropriate document controls, that is reviewed periodically to ensure it remains up to date.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E22),\"\",'8. Risks and DPIAs'!E22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F22),\"\",'8. Risks and DPIAs'!F22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G22),\"\",'8. Risks and DPIAs'!G22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H22),\"\",'8. Risks and DPIAs'!H22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I22),\"\",'8. Risks and DPIAs'!I22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J22),\"\",'8. Risks and DPIAs'!J22)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K22),\"\",'8. Risks and DPIAs'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O22),\"\",'8. Risks and DPIAs'!O22)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.6","Record your DPO’s advice and recommendations and the details of any other consultations.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E23),\"\",'8. Risks and DPIAs'!E23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F23),\"\",'8. Risks and DPIAs'!F23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G23),\"\",'8. Risks and DPIAs'!G23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H23),\"\",'8. Risks and DPIAs'!H23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I23),\"\",'8. Risks and DPIAs'!I23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J23),\"\",'8. Risks and DPIAs'!J23)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K23),\"\",'8. Risks and DPIAs'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O23),\"\",'8. Risks and DPIAs'!O23)","v":""}]
["Risks and Data Protection Impact Assessments.",8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.7","Ensure appropriate people sign off DPIAs, such as a project lead or senior manager.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E24),\"\",'8. Risks and DPIAs'!E24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F24),\"\",'8. Risks and DPIAs'!F24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G24),\"\",'8. Risks and DPIAs'!G24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H24),\"\",'8. Risks and DPIAs'!H24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I24),\"\",'8. Risks and DPIAs'!I24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J24),\"\",'8. Risks and DPIAs'!J24)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K24),\"\",'8. Risks and DPIAs'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O24),\"\",'8. Risks and DPIAs'!O24)","v":""}]
["Risks and Data Protection Impact Assessments.",8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.1","Have a procedure to consult the ICO if you cannot mitigate residual high risks.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E25),\"\",'8. Risks and DPIAs'!E25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F25),\"\",'8. Risks and DPIAs'!F25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G25),\"\",'8. Risks and DPIAs'!G25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H25),\"\",'8. Risks and DPIAs'!H25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I25),\"\",'8. Risks and DPIAs'!I25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J25),\"\",'8. Risks and DPIAs'!J25)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K25),\"\",'8. Risks and DPIAs'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O25),\"\",'8. Risks and DPIAs'!O25)","v":""}]
[{"$f":"A234","v":"Risks and Data Protection Impact Assessments."},8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.2","Integrate outcomes from DPIAs into relevant work plans, project action plans and risk registers.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E26),\"\",'8. Risks and DPIAs'!E26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F26),\"\",'8. Risks and DPIAs'!F26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G26),\"\",'8. Risks and DPIAs'!G26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H26),\"\",'8. Risks and DPIAs'!H26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I26),\"\",'8. Risks and DPIAs'!I26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J26),\"\",'8. Risks and DPIAs'!J26)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K26),\"\",'8. Risks and DPIAs'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O26),\"\",'8. Risks and DPIAs'!O26)","v":""}]
["Risks and Data Protection Impact Assessments.",8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.3","Do not start high risk processing until mitigating measures are in place following the DPIA.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E27),\"\",'8. Risks and DPIAs'!E27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F27),\"\",'8. Risks and DPIAs'!F27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G27),\"\",'8. Risks and DPIAs'!G27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H27),\"\",'8. Risks and DPIAs'!H27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I27),\"\",'8. Risks and DPIAs'!I27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J27),\"\",'8. Risks and DPIAs'!J27)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K27),\"\",'8. Risks and DPIAs'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O27),\"\",'8. Risks and DPIAs'!O27)","v":""}]
["Risks and Data Protection Impact Assessments.",8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.4","Have a procedure to communicate the outcomes of DPIAs to appropriate stakeholders, eg through a formal summarised report.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E28),\"\",'8. Risks and DPIAs'!E28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F28),\"\",'8. Risks and DPIAs'!F28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G28),\"\",'8. Risks and DPIAs'!G28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H28),\"\",'8. Risks and DPIAs'!H28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I28),\"\",'8. Risks and DPIAs'!I28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J28),\"\",'8. Risks and DPIAs'!J28)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K28),\"\",'8. Risks and DPIAs'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O28),\"\",'8. Risks and DPIAs'!O28)","v":""}]
["Risks and Data Protection Impact Assessments.",8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.5","Consider actively publishing DPIAs where possible, removing sensitive details if necessary.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E29),\"\",'8. Risks and DPIAs'!E29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F29),\"\",'8. Risks and DPIAs'!F29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G29),\"\",'8. Risks and DPIAs'!G29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H29),\"\",'8. Risks and DPIAs'!H29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I29),\"\",'8. Risks and DPIAs'!I29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J29),\"\",'8. Risks and DPIAs'!J29)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K29),\"\",'8. Risks and DPIAs'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O29),\"\",'8. Risks and DPIAs'!O29)","v":""}]
["Risks and Data Protection Impact Assessments.",8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.6","Agree and document a schedule for reviewing the DPIA regularly or when the nature, scope, context or purposes of the processing changes.",{"$f":"IF(ISBLANK('8. Risks and DPIAs'!E30),\"\",'8. Risks and DPIAs'!E30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!F30),\"\",'8. Risks and DPIAs'!F30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!G30),\"\",'8. Risks and DPIAs'!G30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!H30),\"\",'8. Risks and DPIAs'!H30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!I30),\"\",'8. Risks and DPIAs'!I30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!J30),\"\",'8. Risks and DPIAs'!J30)","v":""},{"$f":"IF(ISBLANK('8. Risks and DPIAs'!K30),\"\",'8. Risks and DPIAs'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('8. Risks and DPIAs'!O30),\"\",'8. Risks and DPIAs'!O30)","v":""}]
["Records management and security",9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.1","Implement policies and procedures to ensure that you appropriately classify, title and index new records in a way that facilitates management, retrieval and disposal.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E2),\"\",'9. Records management and sec..'!E2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F2),\"\",'9. Records management and sec..'!F2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G2),\"\",'9. Records management and sec..'!G2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H2),\"\",'9. Records management and sec..'!H2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I2),\"\",'9. Records management and sec..'!I2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J2),\"\",'9. Records management and sec..'!J2)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K2),\"\",'9. Records management and sec..'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O2),\"\",'9. Records management and sec..'!O2)","v":""}]
[{"$f":"A240","v":"Records management and security"},{"$f":"B240","v":9.1},"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.2","Identify where you use manual and electronic record-keeping systems and maintain a central log or information asset register.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E3),\"\",'9. Records management and sec..'!E3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F3),\"\",'9. Records management and sec..'!F3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G3),\"\",'9. Records management and sec..'!G3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H3),\"\",'9. Records management and sec..'!H3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I3),\"\",'9. Records management and sec..'!I3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J3),\"\",'9. Records management and sec..'!J3)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K3),\"\",'9. Records management and sec..'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O3),\"\",'9. Records management and sec..'!O3)","v":""}]
["Records management and security",9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.3","Know the whereabouts of records at all times, track their movements, and make attempts to trace records that are missing or not returned.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E4),\"\",'9. Records management and sec..'!E4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F4),\"\",'9. Records management and sec..'!F4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G4),\"\",'9. Records management and sec..'!G4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H4),\"\",'9. Records management and sec..'!H4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I4),\"\",'9. Records management and sec..'!I4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J4),\"\",'9. Records management and sec..'!J4)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K4),\"\",'9. Records management and sec..'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O4),\"\",'9. Records management and sec..'!O4)","v":""}]
["Records management and security",9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.4","Index records stored off-site with unique references to enable accurate retrieval and subsequent tracking.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E5),\"\",'9. Records management and sec..'!E5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F5),\"\",'9. Records management and sec..'!F5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G5),\"\",'9. Records management and sec..'!G5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H5),\"\",'9. Records management and sec..'!H5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I5),\"\",'9. Records management and sec..'!I5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J5),\"\",'9. Records management and sec..'!J5)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K5),\"\",'9. Records management and sec..'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O5),\"\",'9. Records management and sec..'!O5)","v":""}]
["Records management and security",9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.1","Document rules to protect the internal and external transfer of records by post, fax and electronically, for example in a transfer policy or guidance.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E6),\"\",'9. Records management and sec..'!E6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F6),\"\",'9. Records management and sec..'!F6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G6),\"\",'9. Records management and sec..'!G6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H6),\"\",'9. Records management and sec..'!H6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I6),\"\",'9. Records management and sec..'!I6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J6),\"\",'9. Records management and sec..'!J6)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K6),\"\",'9. Records management and sec..'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O6),\"\",'9. Records management and sec..'!O6)","v":""}]
["Records management and security",{"$f":"B244","v":9.1999999999999993},"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.2","Minimise information transferred off-site and keep it secure in transit.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E7),\"\",'9. Records management and sec..'!E7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F7),\"\",'9. Records management and sec..'!F7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G7),\"\",'9. Records management and sec..'!G7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H7),\"\",'9. Records management and sec..'!H7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I7),\"\",'9. Records management and sec..'!I7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J7),\"\",'9. Records management and sec..'!J7)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K7),\"\",'9. Records management and sec..'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O7),\"\",'9. Records management and sec..'!O7)","v":""}]
["Records management and security",9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.3","When you transfer information off site, use an appropriate form of transport (for example secure courier, encryption, secure file transfer protocol (SFTP) or Virtual Private Network (VPN)) and make checks to ensure the information has been received.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E8),\"\",'9. Records management and sec..'!E8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F8),\"\",'9. Records management and sec..'!F8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G8),\"\",'9. Records management and sec..'!G8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H8),\"\",'9. Records management and sec..'!H8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I8),\"\",'9. Records management and sec..'!I8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J8),\"\",'9. Records management and sec..'!J8)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K8),\"\",'9. Records management and sec..'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O8),\"\",'9. Records management and sec..'!O8)","v":""}]
["Records management and security",9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.4","Have agreements in place with any third parties used to transfer business information between your organisation and third parties.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E9),\"\",'9. Records management and sec..'!E9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F9),\"\",'9. Records management and sec..'!F9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G9),\"\",'9. Records management and sec..'!G9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H9),\"\",'9. Records management and sec..'!H9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I9),\"\",'9. Records management and sec..'!I9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J9),\"\",'9. Records management and sec..'!J9)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K9),\"\",'9. Records management and sec..'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O9),\"\",'9. Records management and sec..'!O9)","v":""}]
["Records management and security",9.3000000000000007,"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.1","Conduct regular data quality reviews of records containing personal information to make sure they are accurate, adequate and not excessive.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E10),\"\",'9. Records management and sec..'!E10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F10),\"\",'9. Records management and sec..'!F10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G10),\"\",'9. Records management and sec..'!G10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H10),\"\",'9. Records management and sec..'!H10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I10),\"\",'9. Records management and sec..'!I10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J10),\"\",'9. Records management and sec..'!J10)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K10),\"\",'9. Records management and sec..'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O10),\"\",'9. Records management and sec..'!O10)","v":""}]
["Records management and security",{"$f":"B248","v":9.3000000000000007},"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.2","Make staff aware of data quality issues following data quality checks or audits to prevent recurrence.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E11),\"\",'9. Records management and sec..'!E11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F11),\"\",'9. Records management and sec..'!F11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G11),\"\",'9. Records management and sec..'!G11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H11),\"\",'9. Records management and sec..'!H11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I11),\"\",'9. Records management and sec..'!I11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J11),\"\",'9. Records management and sec..'!J11)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K11),\"\",'9. Records management and sec..'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O11),\"\",'9. Records management and sec..'!O11)","v":""}]
["Records management and security",9.3000000000000007,"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.3","Weed records containing personal information (whether active or archived) periodically to reduce the risks of inaccuracies and excessive retention.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E12),\"\",'9. Records management and sec..'!E12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F12),\"\",'9. Records management and sec..'!F12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G12),\"\",'9. Records management and sec..'!G12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H12),\"\",'9. Records management and sec..'!H12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I12),\"\",'9. Records management and sec..'!I12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J12),\"\",'9. Records management and sec..'!J12)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K12),\"\",'9. Records management and sec..'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O12),\"\",'9. Records management and sec..'!O12)","v":""}]
["Records management and security",9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.1","Have a retention schedule based on business need with reference to statutory requirements and other principles (for example the National Archives).",{"$f":"IF(ISBLANK('9. Records management and sec..'!E13),\"\",'9. Records management and sec..'!E13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F13),\"\",'9. Records management and sec..'!F13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G13),\"\",'9. Records management and sec..'!G13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H13),\"\",'9. Records management and sec..'!H13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I13),\"\",'9. Records management and sec..'!I13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J13),\"\",'9. Records management and sec..'!J13)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K13),\"\",'9. Records management and sec..'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O13),\"\",'9. Records management and sec..'!O13)","v":""}]
["Records management and security",{"$f":"B251","v":9.4},"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.2","Ensure the schedule provides sufficient information to identify all records and to implement disposal decisions in line with the schedule.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E14),\"\",'9. Records management and sec..'!E14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F14),\"\",'9. Records management and sec..'!F14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G14),\"\",'9. Records management and sec..'!G14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H14),\"\",'9. Records management and sec..'!H14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I14),\"\",'9. Records management and sec..'!I14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J14),\"\",'9. Records management and sec..'!J14)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K14),\"\",'9. Records management and sec..'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O14),\"\",'9. Records management and sec..'!O14)","v":""}]
["Records management and security",9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.3","Assign responsibilities to make sure that staff adhere to the schedule and you review it regularly.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E15),\"\",'9. Records management and sec..'!E15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F15),\"\",'9. Records management and sec..'!F15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G15),\"\",'9. Records management and sec..'!G15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H15),\"\",'9. Records management and sec..'!H15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I15),\"\",'9. Records management and sec..'!I15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J15),\"\",'9. Records management and sec..'!J15)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K15),\"\",'9. Records management and sec..'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O15),\"\",'9. Records management and sec..'!O15)","v":""}]
["Records management and security",9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.4","Regularly review retained information to identify opportunities for minimisation, pseudonymisation or anonymisation and document this in the schedule.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E16),\"\",'9. Records management and sec..'!E16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F16),\"\",'9. Records management and sec..'!F16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G16),\"\",'9. Records management and sec..'!G16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H16),\"\",'9. Records management and sec..'!H16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I16),\"\",'9. Records management and sec..'!I16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J16),\"\",'9. Records management and sec..'!J16)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K16),\"\",'9. Records management and sec..'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O16),\"\",'9. Records management and sec..'!O16)","v":""}]
["Records management and security",9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.1","For paper documents, use locked waste bins for records containing personal information, and either in-house or third party cross shredding or incineration is in place.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E17),\"\",'9. Records management and sec..'!E17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F17),\"\",'9. Records management and sec..'!F17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G17),\"\",'9. Records management and sec..'!G17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H17),\"\",'9. Records management and sec..'!H17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I17),\"\",'9. Records management and sec..'!I17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J17),\"\",'9. Records management and sec..'!J17)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K17),\"\",'9. Records management and sec..'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O17),\"\",'9. Records management and sec..'!O17)","v":""}]
["Records management and security",{"$f":"B255","v":9.5},"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.2","For information held on electronic devices, wiping, degaussing or secure destruction of hardware (shredding) is in place.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E18),\"\",'9. Records management and sec..'!E18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F18),\"\",'9. Records management and sec..'!F18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G18),\"\",'9. Records management and sec..'!G18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H18),\"\",'9. Records management and sec..'!H18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I18),\"\",'9. Records management and sec..'!I18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J18),\"\",'9. Records management and sec..'!J18)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K18),\"\",'9. Records management and sec..'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O18),\"\",'9. Records management and sec..'!O18)","v":""}]
["Records management and security",9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.3","Hold, collect or send away securely confidential waste awaiting destruction.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E19),\"\",'9. Records management and sec..'!E19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F19),\"\",'9. Records management and sec..'!F19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G19),\"\",'9. Records management and sec..'!G19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H19),\"\",'9. Records management and sec..'!H19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I19),\"\",'9. Records management and sec..'!I19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J19),\"\",'9. Records management and sec..'!J19)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K19),\"\",'9. Records management and sec..'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O19),\"\",'9. Records management and sec..'!O19)","v":""}]
["Records management and security",9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.4","Have appropriate contracts in place with third parties to dispose of personal information, that provide you with appropriate assurance that they have securely disposed of the information, for example through audit checks and destruction certificates.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E20),\"\",'9. Records management and sec..'!E20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F20),\"\",'9. Records management and sec..'!F20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G20),\"\",'9. Records management and sec..'!G20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H20),\"\",'9. Records management and sec..'!H20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I20),\"\",'9. Records management and sec..'!I20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J20),\"\",'9. Records management and sec..'!J20)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K20),\"\",'9. Records management and sec..'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O20),\"\",'9. Records management and sec..'!O20)","v":""}]
["Records management and security",9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.5","Have a log of all equipment and confidential waste sent for disposal or destruction.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E21),\"\",'9. Records management and sec..'!E21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F21),\"\",'9. Records management and sec..'!F21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G21),\"\",'9. Records management and sec..'!G21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H21),\"\",'9. Records management and sec..'!H21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I21),\"\",'9. Records management and sec..'!I21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J21),\"\",'9. Records management and sec..'!J21)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K21),\"\",'9. Records management and sec..'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O21),\"\",'9. Records management and sec..'!O21)","v":""}]
["Records management and security",9.6,"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.1","Have an asset register that holds details of all information assets (software and hardware) including: \n• asset owners; \n• asset location; \n• retention periods; and \n• security measures deployed.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E22),\"\",'9. Records management and sec..'!E22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F22),\"\",'9. Records management and sec..'!F22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G22),\"\",'9. Records management and sec..'!G22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H22),\"\",'9. Records management and sec..'!H22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I22),\"\",'9. Records management and sec..'!I22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J22),\"\",'9. Records management and sec..'!J22)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K22),\"\",'9. Records management and sec..'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O22),\"\",'9. Records management and sec..'!O22)","v":""}]
["Records management and security",{"$f":"B260","v":9.6},"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.2","Review the register periodically to make sure it remains up to date and accurate.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E23),\"\",'9. Records management and sec..'!E23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F23),\"\",'9. Records management and sec..'!F23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G23),\"\",'9. Records management and sec..'!G23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H23),\"\",'9. Records management and sec..'!H23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I23),\"\",'9. Records management and sec..'!I23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J23),\"\",'9. Records management and sec..'!J23)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K23),\"\",'9. Records management and sec..'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O23),\"\",'9. Records management and sec..'!O23)","v":""}]
["Records management and security",9.6,"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.3","Periodically risk-assess assets within the register and have physical checks to make sure that the hardware asset inventory remains accurate.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E24),\"\",'9. Records management and sec..'!E24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F24),\"\",'9. Records management and sec..'!F24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G24),\"\",'9. Records management and sec..'!G24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H24),\"\",'9. Records management and sec..'!H24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I24),\"\",'9. Records management and sec..'!I24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J24),\"\",'9. Records management and sec..'!J24)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K24),\"\",'9. Records management and sec..'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O24),\"\",'9. Records management and sec..'!O24)","v":""}]
["Records management and security",9.6999999999999993,"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.1","Have acceptable use or terms and conditions of use procedures in place.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E25),\"\",'9. Records management and sec..'!E25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F25),\"\",'9. Records management and sec..'!F25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G25),\"\",'9. Records management and sec..'!G25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H25),\"\",'9. Records management and sec..'!H25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I25),\"\",'9. Records management and sec..'!I25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J25),\"\",'9. Records management and sec..'!J25)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K25),\"\",'9. Records management and sec..'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O25),\"\",'9. Records management and sec..'!O25)","v":""}]
["Records management and security",{"$f":"B263","v":9.6999999999999993},"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.2","Have system operating procedures which document the security arrangements and measures in place to protect the information held within systems or applications.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E26),\"\",'9. Records management and sec..'!E26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F26),\"\",'9. Records management and sec..'!F26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G26),\"\",'9. Records management and sec..'!G26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H26),\"\",'9. Records management and sec..'!H26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I26),\"\",'9. Records management and sec..'!I26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J26),\"\",'9. Records management and sec..'!J26)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K26),\"\",'9. Records management and sec..'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O26),\"\",'9. Records management and sec..'!O26)","v":""}]
["Records management and security",9.6999999999999993,"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.3","Monitor compliance with acceptable use rules and make sure that staff are aware of any monitoring.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E27),\"\",'9. Records management and sec..'!E27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F27),\"\",'9. Records management and sec..'!F27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G27),\"\",'9. Records management and sec..'!G27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H27),\"\",'9. Records management and sec..'!H27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I27),\"\",'9. Records management and sec..'!I27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J27),\"\",'9. Records management and sec..'!J27)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K27),\"\",'9. Records management and sec..'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O27),\"\",'9. Records management and sec..'!O27)","v":""}]
["Records management and security",9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.1","Have an access control policy which specifies that users must follow your organisation's practices in the use of secret authentication information, for example passwords or tokens.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E28),\"\",'9. Records management and sec..'!E28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F28),\"\",'9. Records management and sec..'!F28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G28),\"\",'9. Records management and sec..'!G28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H28),\"\",'9. Records management and sec..'!H28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I28),\"\",'9. Records management and sec..'!I28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J28),\"\",'9. Records management and sec..'!J28)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K28),\"\",'9. Records management and sec..'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O28),\"\",'9. Records management and sec..'!O28)","v":""}]
["Records management and security",{"$f":"B266","v":9.8000000000000007},"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.2","Implement a formal user access provisioning procedure to assign access rights for staff (including temporary staff) and third-party contractors to all relevant systems and services required to fulfil their role, for example 'new starter process'.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E29),\"\",'9. Records management and sec..'!E29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F29),\"\",'9. Records management and sec..'!F29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G29),\"\",'9. Records management and sec..'!G29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H29),\"\",'9. Records management and sec..'!H29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I29),\"\",'9. Records management and sec..'!I29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J29),\"\",'9. Records management and sec..'!J29)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K29),\"\",'9. Records management and sec..'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O29),\"\",'9. Records management and sec..'!O29)","v":""}]
["Records management and security",9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.3","Restrict and control the allocation and use of privileged access rights.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E30),\"\",'9. Records management and sec..'!E30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F30),\"\",'9. Records management and sec..'!F30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G30),\"\",'9. Records management and sec..'!G30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H30),\"\",'9. Records management and sec..'!H30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I30),\"\",'9. Records management and sec..'!I30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J30),\"\",'9. Records management and sec..'!J30)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K30),\"\",'9. Records management and sec..'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O30),\"\",'9. Records management and sec..'!O30)","v":""}]
["Records management and security",9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.4","Keep a log of user access to systems holding personal information.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E31),\"\",'9. Records management and sec..'!E31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F31),\"\",'9. Records management and sec..'!F31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G31),\"\",'9. Records management and sec..'!G31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H31),\"\",'9. Records management and sec..'!H31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I31),\"\",'9. Records management and sec..'!I31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J31),\"\",'9. Records management and sec..'!J31)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K31),\"\",'9. Records management and sec..'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O31),\"\",'9. Records management and sec..'!O31)","v":""}]
["Records management and security",9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.5","Regularly review users’ access rights and adjust or remove rights where appropriate, for example when an employee changes role or leaves the organisation.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E32),\"\",'9. Records management and sec..'!E32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F32),\"\",'9. Records management and sec..'!F32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G32),\"\",'9. Records management and sec..'!G32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H32),\"\",'9. Records management and sec..'!H32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I32),\"\",'9. Records management and sec..'!I32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J32),\"\",'9. Records management and sec..'!J32)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K32),\"\",'9. Records management and sec..'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O32),\"\",'9. Records management and sec..'!O32)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.1","Restrict access to systems or applications processing personal information to the absolute minimum in accordance with the principle of least privilege (for example read/write/delete/execute access rules are applied).",{"$f":"IF(ISBLANK('9. Records management and sec..'!E33),\"\",'9. Records management and sec..'!E33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F33),\"\",'9. Records management and sec..'!F33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G33),\"\",'9. Records management and sec..'!G33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H33),\"\",'9. Records management and sec..'!H33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I33),\"\",'9. Records management and sec..'!I33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J33),\"\",'9. Records management and sec..'!J33)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K33),\"\",'9. Records management and sec..'!K33)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O33),\"\",'9. Records management and sec..'!O33)","v":""}]
["Records management and security",{"$f":"B271","v":9.9},{"$f":"C271","v":"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools."},"9.9.2","Apply minimum password complexity rules and limited log on attempts to systems or applications processing personal information.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E34),\"\",'9. Records management and sec..'!E34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F34),\"\",'9. Records management and sec..'!F34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G34),\"\",'9. Records management and sec..'!G34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H34),\"\",'9. Records management and sec..'!H34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I34),\"\",'9. Records management and sec..'!I34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J34),\"\",'9. Records management and sec..'!J34)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K34),\"\",'9. Records management and sec..'!K34)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O34),\"\",'9. Records management and sec..'!O34)","v":""}]
[{"$f":"A272","v":"Records management and security"},9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.3","Have password management controls in place, including default password changing, controlled use of any shared passwords and secure password storage (not in plain text).",{"$f":"IF(ISBLANK('9. Records management and sec..'!E35),\"\",'9. Records management and sec..'!E35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F35),\"\",'9. Records management and sec..'!F35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G35),\"\",'9. Records management and sec..'!G35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H35),\"\",'9. Records management and sec..'!H35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I35),\"\",'9. Records management and sec..'!I35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J35),\"\",'9. Records management and sec..'!J35)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K35),\"\",'9. Records management and sec..'!K35)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O35),\"\",'9. Records management and sec..'!O35)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.4","Use email content and attachment security solutions (encryption) to appropriately protect emails containing sensitive personal information.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E36),\"\",'9. Records management and sec..'!E36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F36),\"\",'9. Records management and sec..'!F36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G36),\"\",'9. Records management and sec..'!G36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H36),\"\",'9. Records management and sec..'!H36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I36),\"\",'9. Records management and sec..'!I36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J36),\"\",'9. Records management and sec..'!J36)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K36),\"\",'9. Records management and sec..'!K36)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O36),\"\",'9. Records management and sec..'!O36)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.5","Log and monitor user and system activity to detect anything unusual.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E37),\"\",'9. Records management and sec..'!E37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F37),\"\",'9. Records management and sec..'!F37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G37),\"\",'9. Records management and sec..'!G37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H37),\"\",'9. Records management and sec..'!H37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I37),\"\",'9. Records management and sec..'!I37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J37),\"\",'9. Records management and sec..'!J37)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K37),\"\",'9. Records management and sec..'!K37)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O37),\"\",'9. Records management and sec..'!O37)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.6","Implement anti-malware and anti-virus (AV) protection across the network and on critical or sensitive information systems if appropriate.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E38),\"\",'9. Records management and sec..'!E38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F38),\"\",'9. Records management and sec..'!F38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G38),\"\",'9. Records management and sec..'!G38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H38),\"\",'9. Records management and sec..'!H38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I38),\"\",'9. Records management and sec..'!I38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J38),\"\",'9. Records management and sec..'!J38)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K38),\"\",'9. Records management and sec..'!K38)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O38),\"\",'9. Records management and sec..'!O38)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.7","Keep anti-malware and anti-virus protection iup-to-date and configure it to perform regular scans.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E39),\"\",'9. Records management and sec..'!E39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F39),\"\",'9. Records management and sec..'!F39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G39),\"\",'9. Records management and sec..'!G39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H39),\"\",'9. Records management and sec..'!H39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I39),\"\",'9. Records management and sec..'!I39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J39),\"\",'9. Records management and sec..'!J39)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K39),\"\",'9. Records management and sec..'!K39)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O39),\"\",'9. Records management and sec..'!O39)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.8","Ensue your organisation has access to and acts upon any updates on technical vulnerabilities to systems or software, for example vendor’s alerts or patches.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E40),\"\",'9. Records management and sec..'!E40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F40),\"\",'9. Records management and sec..'!F40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G40),\"\",'9. Records management and sec..'!G40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H40),\"\",'9. Records management and sec..'!H40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I40),\"\",'9. Records management and sec..'!I40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J40),\"\",'9. Records management and sec..'!J40)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K40),\"\",'9. Records management and sec..'!K40)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O40),\"\",'9. Records management and sec..'!O40)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.9","Regularly run vulnerability scans.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E41),\"\",'9. Records management and sec..'!E41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F41),\"\",'9. Records management and sec..'!F41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G41),\"\",'9. Records management and sec..'!G41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H41),\"\",'9. Records management and sec..'!H41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I41),\"\",'9. Records management and sec..'!I41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J41),\"\",'9. Records management and sec..'!J41)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K41),\"\",'9. Records management and sec..'!K41)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O41),\"\",'9. Records management and sec..'!O41)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.10","Deploy URL or web content filtering to block specific websites or entire categories.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E42),\"\",'9. Records management and sec..'!E42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F42),\"\",'9. Records management and sec..'!F42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G42),\"\",'9. Records management and sec..'!G42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H42),\"\",'9. Records management and sec..'!H42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I42),\"\",'9. Records management and sec..'!I42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J42),\"\",'9. Records management and sec..'!J42)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K42),\"\",'9. Records management and sec..'!K42)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O42),\"\",'9. Records management and sec..'!O42)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.11","Strictly control or prohibit the use of social media, or messaging apps such as WhatsApp to share personal information.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E43),\"\",'9. Records management and sec..'!E43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F43),\"\",'9. Records management and sec..'!F43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G43),\"\",'9. Records management and sec..'!G43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H43),\"\",'9. Records management and sec..'!H43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I43),\"\",'9. Records management and sec..'!I43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J43),\"\",'9. Records management and sec..'!J43)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K43),\"\",'9. Records management and sec..'!K43)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O43),\"\",'9. Records management and sec..'!O43)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.12","Have external and internal firewalls and intrusion detection systems in place as appropriate to ensure the security of information in networks and systems from unauthorised access or attack, for example denial of service attacks.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E44),\"\",'9. Records management and sec..'!E44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F44),\"\",'9. Records management and sec..'!F44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G44),\"\",'9. Records management and sec..'!G44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H44),\"\",'9. Records management and sec..'!H44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I44),\"\",'9. Records management and sec..'!I44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J44),\"\",'9. Records management and sec..'!J44)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K44),\"\",'9. Records management and sec..'!K44)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O44),\"\",'9. Records management and sec..'!O44)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.13","Do not have unsupported operating systems in use, for example Windows XP or Windows Server 2003.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E45),\"\",'9. Records management and sec..'!E45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F45),\"\",'9. Records management and sec..'!F45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G45),\"\",'9. Records management and sec..'!G45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H45),\"\",'9. Records management and sec..'!H45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I45),\"\",'9. Records management and sec..'!I45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J45),\"\",'9. Records management and sec..'!J45)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K45),\"\",'9. Records management and sec..'!K45)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O45),\"\",'9. Records management and sec..'!O45)","v":""}]
["Records management and security",9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.14","Establish special controls to safeguard the confidentiality and integrity of information passing over public networks or over wireless networks and to protect the connected systems and applications.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E46),\"\",'9. Records management and sec..'!E46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F46),\"\",'9. Records management and sec..'!F46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G46),\"\",'9. Records management and sec..'!G46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H46),\"\",'9. Records management and sec..'!H46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I46),\"\",'9. Records management and sec..'!I46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J46),\"\",'9. Records management and sec..'!J46)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K46),\"\",'9. Records management and sec..'!K46)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O46),\"\",'9. Records management and sec..'!O46)","v":""}]
["Records management and security",9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.1","Have a mobile device and a home/remote working policy that demonstrates how your organisation will manage the associated security risks.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E47),\"\",'9. Records management and sec..'!E47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F47),\"\",'9. Records management and sec..'!F47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G47),\"\",'9. Records management and sec..'!G47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H47),\"\",'9. Records management and sec..'!H47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I47),\"\",'9. Records management and sec..'!I47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J47),\"\",'9. Records management and sec..'!J47)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K47),\"\",'9. Records management and sec..'!K47)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O47),\"\",'9. Records management and sec..'!O47)","v":""}]
["Records management and security",{"$f":"B285","v":9.1},"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.2","Have protections in place to avoid the unauthorised access to or disclosure of the information processed by mobile devices, for example, encryption and remote wiping capabilities.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E48),\"\",'9. Records management and sec..'!E48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F48),\"\",'9. Records management and sec..'!F48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G48),\"\",'9. Records management and sec..'!G48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H48),\"\",'9. Records management and sec..'!H48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I48),\"\",'9. Records management and sec..'!I48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J48),\"\",'9. Records management and sec..'!J48)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K48),\"\",'9. Records management and sec..'!K48)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O48),\"\",'9. Records management and sec..'!O48)","v":""}]
["Records management and security",9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.3","Implement security measures to protect information processed when home or remote working, for example VPN and two-factor authentication.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E49),\"\",'9. Records management and sec..'!E49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F49),\"\",'9. Records management and sec..'!F49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G49),\"\",'9. Records management and sec..'!G49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H49),\"\",'9. Records management and sec..'!H49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I49),\"\",'9. Records management and sec..'!I49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J49),\"\",'9. Records management and sec..'!J49)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K49),\"\",'9. Records management and sec..'!K49)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O49),\"\",'9. Records management and sec..'!O49)","v":""}]
["Records management and security",9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.4","Where you have a business need to store personal information on removable media, minimise personal information and implement a software solution that can set permissions or restrictions for individual devices as well as an entire class of devices.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E50),\"\",'9. Records management and sec..'!E50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F50),\"\",'9. Records management and sec..'!F50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G50),\"\",'9. Records management and sec..'!G50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H50),\"\",'9. Records management and sec..'!H50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I50),\"\",'9. Records management and sec..'!I50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J50),\"\",'9. Records management and sec..'!J50)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K50),\"\",'9. Records management and sec..'!K50)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O50),\"\",'9. Records management and sec..'!O50)","v":""}]
["Records management and security",9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.5","Use the most up-to-date version of your remote access solution. Support and update devices remotely.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E51),\"\",'9. Records management and sec..'!E51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F51),\"\",'9. Records management and sec..'!F51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G51),\"\",'9. Records management and sec..'!G51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H51),\"\",'9. Records management and sec..'!H51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I51),\"\",'9. Records management and sec..'!I51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J51),\"\",'9. Records management and sec..'!J51)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K51),\"\",'9. Records management and sec..'!K51)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O51),\"\",'9. Records management and sec..'!O51)","v":""}]
["Records management and security",9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.6","Do not allow equipment, information or software to be taken off-site without prior authorisation and have a log of all mobile devices and removable media used and who they are allocated to.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E52),\"\",'9. Records management and sec..'!E52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F52),\"\",'9. Records management and sec..'!F52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G52),\"\",'9. Records management and sec..'!G52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H52),\"\",'9. Records management and sec..'!H52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I52),\"\",'9. Records management and sec..'!I52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J52),\"\",'9. Records management and sec..'!J52)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K52),\"\",'9. Records management and sec..'!K52)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O52),\"\",'9. Records management and sec..'!O52)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.1","Protect secure areas (areas that contain either sensitive or critical information) by appropriate entry controls such as doors and locks, alarms, security lighting or CCTV.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E53),\"\",'9. Records management and sec..'!E53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F53),\"\",'9. Records management and sec..'!F53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G53),\"\",'9. Records management and sec..'!G53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H53),\"\",'9. Records management and sec..'!H53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I53),\"\",'9. Records management and sec..'!I53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J53),\"\",'9. Records management and sec..'!J53)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K53),\"\",'9. Records management and sec..'!K53)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O53),\"\",'9. Records management and sec..'!O53)","v":""}]
["Records management and security",{"$f":"B291","v":9.11},"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.2","Have visitor protocols in place such as signing-in procedures, name badges and escorted access.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E54),\"\",'9. Records management and sec..'!E54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F54),\"\",'9. Records management and sec..'!F54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G54),\"\",'9. Records management and sec..'!G54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H54),\"\",'9. Records management and sec..'!H54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I54),\"\",'9. Records management and sec..'!I54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J54),\"\",'9. Records management and sec..'!J54)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K54),\"\",'9. Records management and sec..'!K54)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O54),\"\",'9. Records management and sec..'!O54)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.3","Implement additional protection against external and environmental threats in secure areas such as server rooms.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E55),\"\",'9. Records management and sec..'!E55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F55),\"\",'9. Records management and sec..'!F55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G55),\"\",'9. Records management and sec..'!G55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H55),\"\",'9. Records management and sec..'!H55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I55),\"\",'9. Records management and sec..'!I55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J55),\"\",'9. Records management and sec..'!J55)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K55),\"\",'9. Records management and sec..'!K55)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O55),\"\",'9. Records management and sec..'!O55)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.4","Ensure office equipment is appropriately placed and protected to reduce the risks from environmental threats and opportunities for unauthorised access.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E56),\"\",'9. Records management and sec..'!E56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F56),\"\",'9. Records management and sec..'!F56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G56),\"\",'9. Records management and sec..'!G56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H56),\"\",'9. Records management and sec..'!H56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I56),\"\",'9. Records management and sec..'!I56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J56),\"\",'9. Records management and sec..'!J56)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K56),\"\",'9. Records management and sec..'!K56)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O56),\"\",'9. Records management and sec..'!O56)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.5","Securely store paper records and control access to them.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E57),\"\",'9. Records management and sec..'!E57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F57),\"\",'9. Records management and sec..'!F57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G57),\"\",'9. Records management and sec..'!G57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H57),\"\",'9. Records management and sec..'!H57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I57),\"\",'9. Records management and sec..'!I57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J57),\"\",'9. Records management and sec..'!J57)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K57),\"\",'9. Records management and sec..'!K57)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O57),\"\",'9. Records management and sec..'!O57)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.6","Operate a clear desk policy across your organisation where personal information is processed.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E58),\"\",'9. Records management and sec..'!E58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F58),\"\",'9. Records management and sec..'!F58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G58),\"\",'9. Records management and sec..'!G58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H58),\"\",'9. Records management and sec..'!H58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I58),\"\",'9. Records management and sec..'!I58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J58),\"\",'9. Records management and sec..'!J58)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K58),\"\",'9. Records management and sec..'!K58)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O58),\"\",'9. Records management and sec..'!O58)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.7","Have regular clear desk 'sweeps' or checks and issues are fed back appropriately",{"$f":"IF(ISBLANK('9. Records management and sec..'!E59),\"\",'9. Records management and sec..'!E59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F59),\"\",'9. Records management and sec..'!F59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G59),\"\",'9. Records management and sec..'!G59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H59),\"\",'9. Records management and sec..'!H59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I59),\"\",'9. Records management and sec..'!I59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J59),\"\",'9. Records management and sec..'!J59)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K59),\"\",'9. Records management and sec..'!K59)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O59),\"\",'9. Records management and sec..'!O59)","v":""}]
["Records management and security",9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.8","Operate a 'clear screen' policy across your organisation where personal information is processed.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E60),\"\",'9. Records management and sec..'!E60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F60),\"\",'9. Records management and sec..'!F60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G60),\"\",'9. Records management and sec..'!G60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H60),\"\",'9. Records management and sec..'!H60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I60),\"\",'9. Records management and sec..'!I60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J60),\"\",'9. Records management and sec..'!J60)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K60),\"\",'9. Records management and sec..'!K60)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O60),\"\",'9. Records management and sec..'!O60)","v":""}]
["Records management and security",9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.12.1","Have a risk-based Business Continuity Plan to manage disruption and a Disaster Recovery Plan to manage disasters, which identify records that are critical to the continued functioning of your organisation.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E61),\"\",'9. Records management and sec..'!E61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F61),\"\",'9. Records management and sec..'!F61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G61),\"\",'9. Records management and sec..'!G61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H61),\"\",'9. Records management and sec..'!H61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I61),\"\",'9. Records management and sec..'!I61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J61),\"\",'9. Records management and sec..'!J61)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K61),\"\",'9. Records management and sec..'!K61)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O61),\"\",'9. Records management and sec..'!O61)","v":""}]
[{"$f":"A299","v":"Records management and security"},9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.12.2","Take back-up copies of electronic information, software and systems (and ideally store them off-site).",{"$f":"IF(ISBLANK('9. Records management and sec..'!E62),\"\",'9. Records management and sec..'!E62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F62),\"\",'9. Records management and sec..'!F62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G62),\"\",'9. Records management and sec..'!G62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H62),\"\",'9. Records management and sec..'!H62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I62),\"\",'9. Records management and sec..'!I62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J62),\"\",'9. Records management and sec..'!J62)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K62),\"\",'9. Records management and sec..'!K62)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O62),\"\",'9. Records management and sec..'!O62)","v":""}]
["Records management and security",9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.13.3","Ensure the frequency of backups reflects the sensitivity and importance of the information.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E63),\"\",'9. Records management and sec..'!E63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F63),\"\",'9. Records management and sec..'!F63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G63),\"\",'9. Records management and sec..'!G63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H63),\"\",'9. Records management and sec..'!H63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I63),\"\",'9. Records management and sec..'!I63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J63),\"\",'9. Records management and sec..'!J63)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K63),\"\",'9. Records management and sec..'!K63)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O63),\"\",'9. Records management and sec..'!O63)","v":""}]
["Records management and security",9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.13.4","Regularly test back-ups and recovery processes to ensure they remain fit for purpose.",{"$f":"IF(ISBLANK('9. Records management and sec..'!E64),\"\",'9. Records management and sec..'!E64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!F64),\"\",'9. Records management and sec..'!F64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!G64),\"\",'9. Records management and sec..'!G64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!H64),\"\",'9. Records management and sec..'!H64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!I64),\"\",'9. Records management and sec..'!I64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!J64),\"\",'9. Records management and sec..'!J64)","v":""},{"$f":"IF(ISBLANK('9. Records management and sec..'!K64),\"\",'9. Records management and sec..'!K64)","v":""},null,null,null,{"$f":"IF(ISBLANK('9. Records management and sec..'!O64),\"\",'9. Records management and sec..'!O64)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.1","Have appropriate training in place so that staff are able to recognise a security incident and a personal data breach.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E2),\"\",'10. Breach response and monitor'!E2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F2),\"\",'10. Breach response and monitor'!F2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G2),\"\",'10. Breach response and monitor'!G2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H2),\"\",'10. Breach response and monitor'!H2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I2),\"\",'10. Breach response and monitor'!I2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J2),\"\",'10. Breach response and monitor'!J2)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K2),\"\",'10. Breach response and monitor'!K2)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O2),\"\",'10. Breach response and monitor'!O2)","v":""}]
[{"$f":"A303","v":"Breach response and monitoring"},{"$f":"B303","v":10.1},"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.2","Appoint a dedicated person or team to manage security incidents and personal data breaches.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E3),\"\",'10. Breach response and monitor'!E3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F3),\"\",'10. Breach response and monitor'!F3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G3),\"\",'10. Breach response and monitor'!G3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H3),\"\",'10. Breach response and monitor'!H3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I3),\"\",'10. Breach response and monitor'!I3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J3),\"\",'10. Breach response and monitor'!J3)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K3),\"\",'10. Breach response and monitor'!K3)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O3),\"\",'10. Breach response and monitor'!O3)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.3","Ensure staff know how to escalate a security incident promptly to the appropriate person or team to determine whether a breach has occurred.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E4),\"\",'10. Breach response and monitor'!E4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F4),\"\",'10. Breach response and monitor'!F4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G4),\"\",'10. Breach response and monitor'!G4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H4),\"\",'10. Breach response and monitor'!H4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I4),\"\",'10. Breach response and monitor'!I4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J4),\"\",'10. Breach response and monitor'!J4)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K4),\"\",'10. Breach response and monitor'!K4)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O4),\"\",'10. Breach response and monitor'!O4)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.4","Ensure procedures and systems facilitate the reporting of security incidents and breaches.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E5),\"\",'10. Breach response and monitor'!E5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F5),\"\",'10. Breach response and monitor'!F5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G5),\"\",'10. Breach response and monitor'!G5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H5),\"\",'10. Breach response and monitor'!H5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I5),\"\",'10. Breach response and monitor'!I5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J5),\"\",'10. Breach response and monitor'!J5)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K5),\"\",'10. Breach response and monitor'!K5)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O5),\"\",'10. Breach response and monitor'!O5)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.5","Implement a response plan for promptly addressing any security incidents and personal data breaches that occur.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E6),\"\",'10. Breach response and monitor'!E6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F6),\"\",'10. Breach response and monitor'!F6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G6),\"\",'10. Breach response and monitor'!G6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H6),\"\",'10. Breach response and monitor'!H6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I6),\"\",'10. Breach response and monitor'!I6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J6),\"\",'10. Breach response and monitor'!J6)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K6),\"\",'10. Breach response and monitor'!K6)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O6),\"\",'10. Breach response and monitor'!O6)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.6","Centrally log, record and document both actual breaches and near misses (even if they do not need to be reported to the ICO or people).",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E7),\"\",'10. Breach response and monitor'!E7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F7),\"\",'10. Breach response and monitor'!F7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G7),\"\",'10. Breach response and monitor'!G7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H7),\"\",'10. Breach response and monitor'!H7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I7),\"\",'10. Breach response and monitor'!I7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J7),\"\",'10. Breach response and monitor'!J7)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K7),\"\",'10. Breach response and monitor'!K7)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O7),\"\",'10. Breach response and monitor'!O7)","v":""}]
["Breach response and monitoring",10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.7","Documents in the log the facts relating to the near miss or breach including: \n• its causes; \n• what happened; \n• the personal data affected; \n• the effects of the breach; and \n• any remedial action taken and rationale.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E8),\"\",'10. Breach response and monitor'!E8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F8),\"\",'10. Breach response and monitor'!F8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G8),\"\",'10. Breach response and monitor'!G8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H8),\"\",'10. Breach response and monitor'!H8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I8),\"\",'10. Breach response and monitor'!I8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J8),\"\",'10. Breach response and monitor'!J8)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K8),\"\",'10. Breach response and monitor'!K8)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O8),\"\",'10. Breach response and monitor'!O8)","v":""}]
["Breach response and monitoring",10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.1","Have a procedure to assess the likelihood and severity of the risk to people as a result of a personal data breach.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E9),\"\",'10. Breach response and monitor'!E9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F9),\"\",'10. Breach response and monitor'!F9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G9),\"\",'10. Breach response and monitor'!G9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H9),\"\",'10. Breach response and monitor'!H9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I9),\"\",'10. Breach response and monitor'!I9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J9),\"\",'10. Breach response and monitor'!J9)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K9),\"\",'10. Breach response and monitor'!K9)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O9),\"\",'10. Breach response and monitor'!O9)","v":""}]
["Breach response and monitoring",{"$f":"B310","v":10.199999999999999},"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.2","Have a procedure to notify the ICO of a breach within 72 hours of becoming aware of it (even when all the information is not yet available) and notify the ICO on time.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E10),\"\",'10. Breach response and monitor'!E10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F10),\"\",'10. Breach response and monitor'!F10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G10),\"\",'10. Breach response and monitor'!G10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H10),\"\",'10. Breach response and monitor'!H10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I10),\"\",'10. Breach response and monitor'!I10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J10),\"\",'10. Breach response and monitor'!J10)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K10),\"\",'10. Breach response and monitor'!K10)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O10),\"\",'10. Breach response and monitor'!O10)","v":""}]
["Breach response and monitoring",10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.3","Ensure the procedure includes details of what information must be given to the ICO about the breach.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E11),\"\",'10. Breach response and monitor'!E11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F11),\"\",'10. Breach response and monitor'!F11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G11),\"\",'10. Breach response and monitor'!G11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H11),\"\",'10. Breach response and monitor'!H11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I11),\"\",'10. Breach response and monitor'!I11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J11),\"\",'10. Breach response and monitor'!J11)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K11),\"\",'10. Breach response and monitor'!K11)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O11),\"\",'10. Breach response and monitor'!O11)","v":""}]
["Breach response and monitoring",10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.4","If you consider it unnecessary to report a breach, document the reasons why your organisation considers the breach unlikely to result in a risk to the rights and freedoms of people.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E12),\"\",'10. Breach response and monitor'!E12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F12),\"\",'10. Breach response and monitor'!F12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G12),\"\",'10. Breach response and monitor'!G12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H12),\"\",'10. Breach response and monitor'!H12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I12),\"\",'10. Breach response and monitor'!I12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J12),\"\",'10. Breach response and monitor'!J12)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K12),\"\",'10. Breach response and monitor'!K12)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O12),\"\",'10. Breach response and monitor'!O12)","v":""}]
["Breach response and monitoring",10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.1","Have a procedure setting out how you will tell affected people about a breach when it is likely to result in a high risk to their rights and freedoms.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E13),\"\",'10. Breach response and monitor'!E13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F13),\"\",'10. Breach response and monitor'!F13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G13),\"\",'10. Breach response and monitor'!G13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H13),\"\",'10. Breach response and monitor'!H13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I13),\"\",'10. Breach response and monitor'!I13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J13),\"\",'10. Breach response and monitor'!J13)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K13),\"\",'10. Breach response and monitor'!K13)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O13),\"\",'10. Breach response and monitor'!O13)","v":""}]
["Breach response and monitoring",{"$f":"B314","v":10.3},"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.2","Tell people about personal data breaches in clear, plain language without undue delay",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E14),\"\",'10. Breach response and monitor'!E14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F14),\"\",'10. Breach response and monitor'!F14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G14),\"\",'10. Breach response and monitor'!G14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H14),\"\",'10. Breach response and monitor'!H14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I14),\"\",'10. Breach response and monitor'!I14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J14),\"\",'10. Breach response and monitor'!J14)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K14),\"\",'10. Breach response and monitor'!K14)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O14),\"\",'10. Breach response and monitor'!O14)","v":""}]
["Breach response and monitoring",10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.3","Ensure the information you provide to people includes the DPO’s details, a description of the likely consequences of the breach and the measures taken (including mitigating actions and any possible adverse effects).",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E15),\"\",'10. Breach response and monitor'!E15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F15),\"\",'10. Breach response and monitor'!F15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G15),\"\",'10. Breach response and monitor'!G15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H15),\"\",'10. Breach response and monitor'!H15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I15),\"\",'10. Breach response and monitor'!I15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J15),\"\",'10. Breach response and monitor'!J15)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K15),\"\",'10. Breach response and monitor'!K15)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O15),\"\",'10. Breach response and monitor'!O15)","v":""}]
["Breach response and monitoring",10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.4","Provide people with advice to protect themselves from any effects of the breach.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E16),\"\",'10. Breach response and monitor'!E16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F16),\"\",'10. Breach response and monitor'!F16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G16),\"\",'10. Breach response and monitor'!G16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H16),\"\",'10. Breach response and monitor'!H16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I16),\"\",'10. Breach response and monitor'!I16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J16),\"\",'10. Breach response and monitor'!J16)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K16),\"\",'10. Breach response and monitor'!K16)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O16),\"\",'10. Breach response and monitor'!O16)","v":""}]
["Breach response and monitoring",10.4,"Personal data breaches are reviewed and monitored.","10.4.1","Analyse all personal data breach reports to prevent a recurrence.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E17),\"\",'10. Breach response and monitor'!E17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F17),\"\",'10. Breach response and monitor'!F17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G17),\"\",'10. Breach response and monitor'!G17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H17),\"\",'10. Breach response and monitor'!H17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I17),\"\",'10. Breach response and monitor'!I17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J17),\"\",'10. Breach response and monitor'!J17)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K17),\"\",'10. Breach response and monitor'!K17)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O17),\"\",'10. Breach response and monitor'!O17)","v":""}]
["Breach response and monitoring",{"$f":"B318","v":10.4},"Personal data breaches are reviewed and monitored.","10.4.2","Monitor the type, volume and cost of incidents.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E18),\"\",'10. Breach response and monitor'!E18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F18),\"\",'10. Breach response and monitor'!F18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G18),\"\",'10. Breach response and monitor'!G18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H18),\"\",'10. Breach response and monitor'!H18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I18),\"\",'10. Breach response and monitor'!I18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J18),\"\",'10. Breach response and monitor'!J18)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K18),\"\",'10. Breach response and monitor'!K18)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O18),\"\",'10. Breach response and monitor'!O18)","v":""}]
["Breach response and monitoring",10.4,"Personal data breaches are reviewed and monitored.","10.4.3","Undertake trend analysis on breach reports over time to understand themes or issues.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E19),\"\",'10. Breach response and monitor'!E19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F19),\"\",'10. Breach response and monitor'!F19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G19),\"\",'10. Breach response and monitor'!G19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H19),\"\",'10. Breach response and monitor'!H19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I19),\"\",'10. Breach response and monitor'!I19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J19),\"\",'10. Breach response and monitor'!J19)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K19),\"\",'10. Breach response and monitor'!K19)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O19),\"\",'10. Breach response and monitor'!O19)","v":""}]
["Breach response and monitoring",10.4,"Personal data breaches are reviewed and monitored.","10.4.4","Ensure groups with oversight for data protection and information governance review the outputs.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E20),\"\",'10. Breach response and monitor'!E20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F20),\"\",'10. Breach response and monitor'!F20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G20),\"\",'10. Breach response and monitor'!G20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H20),\"\",'10. Breach response and monitor'!H20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I20),\"\",'10. Breach response and monitor'!I20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J20),\"\",'10. Breach response and monitor'!J20)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K20),\"\",'10. Breach response and monitor'!K20)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O20),\"\",'10. Breach response and monitor'!O20)","v":""}]
["Breach response and monitoring",10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.1","Complete externally-provided self-assessment tools to provide assurances on data protection and information security compliance.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E21),\"\",'10. Breach response and monitor'!E21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F21),\"\",'10. Breach response and monitor'!F21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G21),\"\",'10. Breach response and monitor'!G21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H21),\"\",'10. Breach response and monitor'!H21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I21),\"\",'10. Breach response and monitor'!I21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J21),\"\",'10. Breach response and monitor'!J21)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K21),\"\",'10. Breach response and monitor'!K21)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O21),\"\",'10. Breach response and monitor'!O21)","v":""}]
["Breach response and monitoring",{"$f":"B322","v":10.5},"There are external data protection and information governance audits or other compliance checking procedures.","10.5.2","Ensure your organisation is subject to or employs the services of an external auditor to provide independent assurances (or certification) on data protection and information security compliance.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E22),\"\",'10. Breach response and monitor'!E22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F22),\"\",'10. Breach response and monitor'!F22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G22),\"\",'10. Breach response and monitor'!G22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H22),\"\",'10. Breach response and monitor'!H22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I22),\"\",'10. Breach response and monitor'!I22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J22),\"\",'10. Breach response and monitor'!J22)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K22),\"\",'10. Breach response and monitor'!K22)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O22),\"\",'10. Breach response and monitor'!O22)","v":""}]
["Breach response and monitoring",10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.3","Adhere to an appropriate code of conduct or practice for your sector (if one exists).",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E23),\"\",'10. Breach response and monitor'!E23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F23),\"\",'10. Breach response and monitor'!F23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G23),\"\",'10. Breach response and monitor'!G23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H23),\"\",'10. Breach response and monitor'!H23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I23),\"\",'10. Breach response and monitor'!I23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J23),\"\",'10. Breach response and monitor'!J23)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K23),\"\",'10. Breach response and monitor'!K23)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O23),\"\",'10. Breach response and monitor'!O23)","v":""}]
["Breach response and monitoring",10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.4","Produce audit reports to document the findings.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E24),\"\",'10. Breach response and monitor'!E24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F24),\"\",'10. Breach response and monitor'!F24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G24),\"\",'10. Breach response and monitor'!G24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H24),\"\",'10. Breach response and monitor'!H24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I24),\"\",'10. Breach response and monitor'!I24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J24),\"\",'10. Breach response and monitor'!J24)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K24),\"\",'10. Breach response and monitor'!K24)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O24),\"\",'10. Breach response and monitor'!O24)","v":""}]
["Breach response and monitoring",10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.5","Have a central action plan in place to take forward the outputs from data protection and information governance audits.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E25),\"\",'10. Breach response and monitor'!E25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F25),\"\",'10. Breach response and monitor'!F25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G25),\"\",'10. Breach response and monitor'!G25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H25),\"\",'10. Breach response and monitor'!H25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I25),\"\",'10. Breach response and monitor'!I25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J25),\"\",'10. Breach response and monitor'!J25)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K25),\"\",'10. Breach response and monitor'!K25)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O25),\"\",'10. Breach response and monitor'!O25)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.1","Monitor your own data protection compliance and regularly test the effectiveness of the measures you have in place.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E26),\"\",'10. Breach response and monitor'!E26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F26),\"\",'10. Breach response and monitor'!F26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G26),\"\",'10. Breach response and monitor'!G26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H26),\"\",'10. Breach response and monitor'!H26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I26),\"\",'10. Breach response and monitor'!I26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J26),\"\",'10. Breach response and monitor'!J26)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K26),\"\",'10. Breach response and monitor'!K26)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O26),\"\",'10. Breach response and monitor'!O26)","v":""}]
["Breach response and monitoring",{"$f":"B327","v":10.6},"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.2","Regularly test staff adherence to data protection and information governance policies and procedures.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E27),\"\",'10. Breach response and monitor'!E27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F27),\"\",'10. Breach response and monitor'!F27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G27),\"\",'10. Breach response and monitor'!G27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H27),\"\",'10. Breach response and monitor'!H27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I27),\"\",'10. Breach response and monitor'!I27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J27),\"\",'10. Breach response and monitor'!J27)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K27),\"\",'10. Breach response and monitor'!K27)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O27),\"\",'10. Breach response and monitor'!O27)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.3","Routinely conduct informal ad-hoc monitoring and spot checks.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E28),\"\",'10. Breach response and monitor'!E28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F28),\"\",'10. Breach response and monitor'!F28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G28),\"\",'10. Breach response and monitor'!G28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H28),\"\",'10. Breach response and monitor'!H28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I28),\"\",'10. Breach response and monitor'!I28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J28),\"\",'10. Breach response and monitor'!J28)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K28),\"\",'10. Breach response and monitor'!K28)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O28),\"\",'10. Breach response and monitor'!O28)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.4","Ensure your monitoring of policy compliance is unbiased by keeping it separate from those who implement the policies.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E29),\"\",'10. Breach response and monitor'!E29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F29),\"\",'10. Breach response and monitor'!F29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G29),\"\",'10. Breach response and monitor'!G29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H29),\"\",'10. Breach response and monitor'!H29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I29),\"\",'10. Breach response and monitor'!I29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J29),\"\",'10. Breach response and monitor'!J29)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K29),\"\",'10. Breach response and monitor'!K29)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O29),\"\",'10. Breach response and monitor'!O29)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.5","Have a central audit plan/schedule in place to show the planning of data protection and information governance internal audits.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E30),\"\",'10. Breach response and monitor'!E30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F30),\"\",'10. Breach response and monitor'!F30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G30),\"\",'10. Breach response and monitor'!G30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H30),\"\",'10. Breach response and monitor'!H30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I30),\"\",'10. Breach response and monitor'!I30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J30),\"\",'10. Breach response and monitor'!J30)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K30),\"\",'10. Breach response and monitor'!K30)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O30),\"\",'10. Breach response and monitor'!O30)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.6","Produce audit reports to document the findings.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E31),\"\",'10. Breach response and monitor'!E31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F31),\"\",'10. Breach response and monitor'!F31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G31),\"\",'10. Breach response and monitor'!G31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H31),\"\",'10. Breach response and monitor'!H31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I31),\"\",'10. Breach response and monitor'!I31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J31),\"\",'10. Breach response and monitor'!J31)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K31),\"\",'10. Breach response and monitor'!K31)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O31),\"\",'10. Breach response and monitor'!O31)","v":""}]
["Breach response and monitoring",10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.7","Have a central action plan in place to take forward the outputs from data protection and information governance audits.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E32),\"\",'10. Breach response and monitor'!E32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F32),\"\",'10. Breach response and monitor'!F32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G32),\"\",'10. Breach response and monitor'!G32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H32),\"\",'10. Breach response and monitor'!H32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I32),\"\",'10. Breach response and monitor'!I32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J32),\"\",'10. Breach response and monitor'!J32)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K32),\"\",'10. Breach response and monitor'!K32)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O32),\"\",'10. Breach response and monitor'!O32)","v":""}]
["Breach response and monitoring",10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.1","Have KPIs regarding subject access request (SAR) performance (the volume of requests and the percentage completed within statutory timescales).",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E33),\"\",'10. Breach response and monitor'!E33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F33),\"\",'10. Breach response and monitor'!F33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G33),\"\",'10. Breach response and monitor'!G33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H33),\"\",'10. Breach response and monitor'!H33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I33),\"\",'10. Breach response and monitor'!I33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J33),\"\",'10. Breach response and monitor'!J33)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K33),\"\",'10. Breach response and monitor'!K33)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O33),\"\",'10. Breach response and monitor'!O33)","v":""}]
["Breach response and monitoring",{"$f":"B334","v":10.7},"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.2","Have KPIs regarding the completion of data protection and information governance training, including a report showing the percentage of staff who complete training.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E34),\"\",'10. Breach response and monitor'!E34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F34),\"\",'10. Breach response and monitor'!F34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G34),\"\",'10. Breach response and monitor'!G34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H34),\"\",'10. Breach response and monitor'!H34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I34),\"\",'10. Breach response and monitor'!I34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J34),\"\",'10. Breach response and monitor'!J34)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K34),\"\",'10. Breach response and monitor'!K34)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O34),\"\",'10. Breach response and monitor'!O34)","v":""}]
["Breach response and monitoring",10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.3","Have KPIs regarding information security, including the number of security breaches, incidents and near misses.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E35),\"\",'10. Breach response and monitor'!E35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F35),\"\",'10. Breach response and monitor'!F35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G35),\"\",'10. Breach response and monitor'!G35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H35),\"\",'10. Breach response and monitor'!H35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I35),\"\",'10. Breach response and monitor'!I35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J35),\"\",'10. Breach response and monitor'!J35)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K35),\"\",'10. Breach response and monitor'!K35)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O35),\"\",'10. Breach response and monitor'!O35)","v":""}]
["Breach response and monitoring",10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.4","Have KPIs regarding records management, including the use of metrics such as file retrieval statistics, adherence to disposal schedules and the performance of the system in place to index and track paper files containing personal information.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E36),\"\",'10. Breach response and monitor'!E36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F36),\"\",'10. Breach response and monitor'!F36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G36),\"\",'10. Breach response and monitor'!G36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H36),\"\",'10. Breach response and monitor'!H36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I36),\"\",'10. Breach response and monitor'!I36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J36),\"\",'10. Breach response and monitor'!J36)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K36),\"\",'10. Breach response and monitor'!K36)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O36),\"\",'10. Breach response and monitor'!O36)","v":""}]
["Breach response and monitoring",10.8,"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.1","Have a dashboard giving a high-level summary of all key data protection and information governance KPIs.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E37),\"\",'10. Breach response and monitor'!E37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F37),\"\",'10. Breach response and monitor'!F37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G37),\"\",'10. Breach response and monitor'!G37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H37),\"\",'10. Breach response and monitor'!H37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I37),\"\",'10. Breach response and monitor'!I37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J37),\"\",'10. Breach response and monitor'!J37)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K37),\"\",'10. Breach response and monitor'!K37)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O37),\"\",'10. Breach response and monitor'!O37)","v":""}]
[{"$f":"A338","v":"Breach response and monitoring"},10.8,"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.2","Regularly discuss KPIs and the outcomes of monitoring and reviews at the group(s) providing oversight of data protection and information governance.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E38),\"\",'10. Breach response and monitor'!E38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F38),\"\",'10. Breach response and monitor'!F38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G38),\"\",'10. Breach response and monitor'!G38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H38),\"\",'10. Breach response and monitor'!H38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I38),\"\",'10. Breach response and monitor'!I38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J38),\"\",'10. Breach response and monitor'!J38)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K38),\"\",'10. Breach response and monitor'!K38)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O38),\"\",'10. Breach response and monitor'!O38)","v":""}]
["Breach response and monitoring",10.8,"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.3","Discuss data protection and information governance KPIs and the outcomes of monitoring and reviews at groups at operational level, for example in team meetings.",{"$f":"IF(ISBLANK('10. Breach response and monitor'!E39),\"\",'10. Breach response and monitor'!E39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!F39),\"\",'10. Breach response and monitor'!F39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!G39),\"\",'10. Breach response and monitor'!G39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!H39),\"\",'10. Breach response and monitor'!H39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!I39),\"\",'10. Breach response and monitor'!I39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!J39),\"\",'10. Breach response and monitor'!J39)","v":""},{"$f":"IF(ISBLANK('10. Breach response and monitor'!K39),\"\",'10. Breach response and monitor'!K39)","v":""},null,null,null,{"$f":"IF(ISBLANK('10. Breach response and monitor'!O39),\"\",'10. Breach response and monitor'!O39)","v":""}]

{"sheet":"Tables & Graphs","index":3,"n_rows":27,"n_cols":12,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Leadership & Oversight","2. Policies & Procedures","3. Training & Awareness","4. Individuals' Rights","5. Transparency","6. ROPA & Lawful Basis","7. Contracts & Data Sharing","8. Risks & DPIAs","9. Records Management & Security","10. Breach Response & Monitoring","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Leadership and oversight'!E:E,A2)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Training and awareness'!E:E,A2)","v":0},{"$f":"COUNTIF('4. Information rights'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Transparency'!E:E,A2)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!E:E,A2)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!E:E,A2)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!E:E,A2)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!E:E,A2)","v":0},{"$f":"SUM(B2:K2)","v":0}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Leadership and oversight'!E:E,A3)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Training and awareness'!E:E,A3)","v":0},{"$f":"COUNTIF('4. Information rights'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Transparency'!E:E,A3)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!E:E,A3)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!E:E,A3)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!E:E,A3)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!E:E,A3)","v":0},{"$f":"SUM(B3:K3)","v":0}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Leadership and oversight'!E:E,A4)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Training and awareness'!E:E,A4)","v":0},{"$f":"COUNTIF('4. Information rights'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Transparency'!E:E,A4)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!E:E,A4)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!E:E,A4)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!E:E,A4)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!E:E,A4)","v":0},0]
["Not Applicable",{"$f":"COUNTIF('1. Leadership and oversight'!E:E,A5)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Training and awareness'!E:E,A5)","v":0},{"$f":"COUNTIF('4. Information rights'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Transparency'!E:E,A5)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!E:E,A5)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!E:E,A5)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!E:E,A5)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!E:E,A5)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Leadership and oversight'!E2:E34)","v":33},{"$f":"COUNTBLANK('2. Policies and procedures'!E2:E18)","v":17},{"$f":"COUNTBLANK('3. Training and awareness'!E2:E22)","v":21},{"$f":"COUNTBLANK('4. Information rights'!E2:E43)","v":42},{"$f":"COUNTBLANK('5. Transparency'!E2:E32)","v":31},{"$f":"COUNTBLANK('6 ROPA and lawful basis'!E2:E34)","v":33},{"$f":"COUNTBLANK('7. Contracts and data sharing'!E2:E32)","v":31},{"$f":"COUNTBLANK('8. Risks and DPIAs'!E2:E30)","v":29},{"$f":"COUNTBLANK('9. Records management and sec..'!E2:E64)","v":63},{"$f":"COUNTBLANK('10. Breach response and monitor'!E2:E39)","v":38},{"$f":"SUM(B6:K6)","v":338}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Leadership & Oversight","2. Policies & Procedures","3. Training & Awareness","4. Individuals' Rights","5. Transparency","6. ROPA & Lawful Basis","7. Contracts & Data Sharing","8. Risks & DPIAs","9. Records Management & Security","10. Breach Response & Monitoring","Total"]
["Not started",{"$f":"COUNTIF('1. Leadership and oversight'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Training and awareness'!I:I,A18)","v":0},{"$f":"COUNTIF('4. Information rights'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Transparency'!I:I,A18)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!I:I,A18)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!I:I,A18)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!I:I,A18)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!I:I,A18)","v":0},{"$f":"SUM(B18:K18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Leadership and oversight'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Training and awareness'!I:I,A19)","v":0},{"$f":"COUNTIF('4. Information rights'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Transparency'!I:I,A19)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!I:I,A19)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!I:I,A19)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!I:I,A19)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!I:I,A19)","v":0},0]
["On track",{"$f":"COUNTIF('1. Leadership and oversight'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Training and awareness'!I:I,A20)","v":0},{"$f":"COUNTIF('4. Information rights'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Transparency'!I:I,A20)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!I:I,A20)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!I:I,A20)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!I:I,A20)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Leadership and oversight'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Training and awareness'!I:I,A21)","v":0},{"$f":"COUNTIF('4. Information rights'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Transparency'!I:I,A21)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!I:I,A21)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!I:I,A21)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!I:I,A21)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Leadership and oversight'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Training and awareness'!I:I,A22)","v":0},{"$f":"COUNTIF('4. Information rights'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Transparency'!I:I,A22)","v":0},{"$f":"COUNTIF('6 ROPA and lawful basis'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Contracts and data sharing'!I:I,A22)","v":0},{"$f":"COUNTIF('8. Risks and DPIAs'!I:I,A22)","v":0},{"$f":"COUNTIF('9. Records management and sec..'!I:I,A22)","v":0},{"$f":"COUNTIF('10. Breach response and monitor'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Leadership and oversight'!I2:I34)","v":33},{"$f":"COUNTBLANK('2. Policies and procedures'!I2:I18)","v":17},{"$f":"COUNTBLANK('3. Training and awareness'!I2:I22)","v":21},{"$f":"COUNTBLANK('4. Information rights'!I2:I43)","v":42},{"$f":"COUNTBLANK('5. Transparency'!I2:I32)","v":31},{"$f":"COUNTBLANK('6 ROPA and lawful basis'!I2:I34)","v":33},{"$f":"COUNTBLANK('7. Contracts and data sharing'!I2:I32)","v":31},{"$f":"COUNTBLANK('8. Risks and DPIAs'!I2:I30)","v":29},{"$f":"COUNTBLANK('9. Records management and sec..'!I2:I64)","v":63},{"$f":"COUNTBLANK('10. Breach response and monitor'!I2:I39)","v":38},338]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:K18)","v":0},{"$f":"SUM(B19:K19)","v":0},{"$f":"SUM(B20:K20)","v":0},{"$f":"SUM(B21:K21)","v":0},{"$f":"SUM(B22:K22)","v":0},{"$f":"SUM(B23:K23)","v":338}]

{"sheet":"Lookup","index":4,"n_rows":9,"n_cols":7,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Fully meeting our expectation",null,null,null,"Not started",null,"Not started"]
["Partially meeting our expectation",null,null,null,"Action rejected",null,"In progress"]
["Not meeting our expectation",null,null,null,"On track",null,"Overdue"]
["Not Applicable",null,null,null,"Overdue",null,"Completed"]
[null,null,null,null,"Completed"]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-24"}]

{"sheet":"1. Leadership and oversight","index":5,"n_rows":34,"n_cols":10,"rows_kept":34,"cut":false,"hidden":false,"merged":[[1,1,7,1],[1,0,7,0],[8,1,12,1],[8,0,12,0],[13,1,18,1],[13,0,18,0],[19,1,22,1],[23,1,29,1],[23,0,29,0],[30,1,33,1],[30,0,33,0],[19,0,22,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"There is an organisational structure for managing data protection and information governance, which provides strong leadership and oversight, clear reporting lines and responsibilities, and effective information flows.","1.1.1","Assign overall responsibility for data protection and information governance to the board, or highest senior management level."]
[null,null,"1.1.2","Promote a proactive, positive culture of data protection compliance and ensure decision-makers lead by example."]
[null,null,"1.1.3","Establish clear reporting lines and information flows between relevant groups; such as from a management board to an audit committee, or from an executive team to an information governance steering group."]
[null,null,"1.1.4","Clearly set out in policies the organisational structure for managing data protection and information governance."]
[null,null,"1.1.5","Set out responsibilities and reporting lines to management in job descriptions."]
[null,null,"1.1.6","Ensure job descriptions are up-to-date, fit for purpose and reviewed regularly."]
[null,null,"1.1.7","Ensure data protection and information governance staff understand the organisational structure and their responsibilities."]
[1.2000000000000002,"If it is necessary to appoint a DPO under Article 37 of the UK GDPR, the DPO’s role is adequately supported and covers all the requirements and responsibilities.",1.2,"Ensure the DPO has specific responsibilities in line with Article 39 of the UK GDPR for data protection compliance, data protection policies, awareness raising, training and audits."]
[null,null,"1.2.2","Ensure the DPO has expert knowledge of data protection law and practices."]
[null,null,"1.2.3","Ensure the DPO has the authority, support and resources to do their job effectively."]
[null,null,"1.2.4","Document the decision and rationale for not appointing a DPO, if that is the case. "]
[null,null,"1.2.5","If your organisation is not required to appoint a DPO, assign responsibility for data protection compliance and ensure there are enough staff and resources to discharge data protection compliance obligations."]
[1.3000000000000003,"The DPO is independent and unbiased. They report to the highest management level and staff are clear about how to contact them.","1.3.1","Educate staff so they who the DPO is, what their role is and how to contact them."]
[null,null,"1.3.2","Involve the DPO in all data protection issues in a timely manner."]
[null,null,"1.3.3","Demonstrate that you follow the DPO’s advice and take account of their knowledge about data protection obligations."]
[null,null,"1.3.4","Ensure the DPO performs their tasks independently, without any conflicts of interest, and does not take any direct operational decisions about the manner and purposes of processing personal information within your organisation."]
[null,null,"1.3.5","Evidence that the DPO directly advises senior decision-makers and has the ability to raise concerns with the highest management level."]
[null,null,"1.3.6","Ensure the DPO provides senior management with regular updates about data protection compliance."]
[1.4000000000000004,"There are operational roles in place to support the practical implementation of data protection and information governance.","1.4.1","Ensure data protection and information governance staff have clear responsibilities to support your organisations data protection compliance."]
[null,null,"1.4.2","Manage all records effectively and keep information secure."]
[null,null,"1.4.3","Put in place a network of support or nominated data protection leads help to implement and maintain data protection policies at a local level."]
[null,null,"1.4.4","Ensure data protection and information governance staff have the authority, support and resources to carry out their responsibilities effectively."]
[1.5000000000000004,"There is an oversight group which provides direction and guidance across your organisation for data protection and information governance activities.","1.5.1","Ensure key staff, eg the DPO, regularly attend the oversight group meetings."]
[null,null,"1.5.2","Ensure an appropriately senior staff member chairs the group, eg the DPO or senior information risk owner (SIRO)."]
[null,null,"1.5.3","Document clear terms of reference that set out the group's aims."]
[null,null,"1.5.4","Take detailed meeting minutes to record discussions, actions and decisions."]
[null,null,"1.5.5","Ensure the group covers a full range of data protection-related topics including key performance indicators (KPIs), issues and risks."]
[null,null,"1.5.6","Feed outcomes into a work or action plan and regularly review the plan."]
[null,null,"1.5.7","Report data protection and information governance issues and risks covered at the oversight group to the board or highest management level."]
[1.6000000000000005,"There are operational level groups that meet to discuss and coordinate data protection and information governance activities.","1.6.1","Ensure the groups meet regularly and are attended by relevant staff."]
[null,null,"1.6.2","Take and produce minutes of the meetings and action plans."]
[null,null,"1.6.3","Discuss appropriate data protection and information governance issues in the group."]
[null,null,"1.6.4","Report any data protection and information governance issues and risks that arise to the oversight group."]

{"sheet":"2. Policies and procedures","index":6,"n_rows":18,"n_cols":10,"rows_kept":18,"cut":false,"hidden":false,"merged":[[14,1,17,1],[14,0,17,0],[1,1,4,1],[1,0,4,0],[5,1,9,1],[5,0,9,0],[10,1,13,1],[10,0,13,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.1","Ensure the policy framework stems from strategic business planning for data protection and information governance, which the highest level of management endorses."]
[{"$f":"A2","v":2.1},"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.2","Implement policies that cover data protection, records management and information security."]
[2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.3","Make operational procedures, guidance and manuals readily available to support data protection policies and provide direction to operational staff."]
[2.1,"Policies and procedures provide staff with enough direction to understand their data protection and information governance roles and responsibilities. ","2.1.4","Ensure policies and procedures clearly outline roles and responsibilities."]
[2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.1","Ensure all policies and procedures follow an agreed format and style."]
[{"$f":"A6","v":2.2000000000000002},"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.2","Ensure an appropriately senior staff member reviews and approves all new and existing policies and procedures."]
[2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.3","Review existing policies and procedures in line with documented review dates, so they are up-to-date and fit for purpose."]
[2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.4","Update policies and procedures without undue delay when they require changes, eg because of operational change, court or regulatory decisions or changes in regulatory guidance."]
[2.2000000000000002,"There is a review and approval process in place to make sure that policies and procedures are consistent and effective.","2.2.5","Show document control information, including version number, owner, review date and change history in all policies, procedures and guidelines."]
[2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.1","Ensure staff read and understand the policies and procedures, including why they are important to implement and comply with."]
[{"$f":"A11","v":2.2999999999999998},"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.2","Tell staff about updated policies and procedures."]
[2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.3","Make policies and procedures readily available for all staff on your organisation’s intranet site (or equivalent shared area) or provide them in other formats."]
[2.2999999999999998,"Staff are fully aware of the data protection and information governance policies and procedures that are relevant to their role.","2.3.4","Use guidelines, posters or publications to help to emphasise key messages and raise staff awareness of policies and procedures."]
[2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.1","Where relevant, consider policies and procedures across your organisation with data protection in mind."]
[{"$f":"A15","v":2.4},"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.2","Implement policies and procedures to ensure data protection issues are considered when systems, services, products and business practices involving personal information are designed and implemented, and that personal information is protected by default."]
[2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.3","Set out your organisation’s approach to implementing the data protection principles and safeguarding people’s rights, such as data minimisation, pseudonymisation and purpose limitation, in policies and procedures."]
[2.4,"Policies and procedures foster a ‘data protection by design and by default’ approach across the organisation.","2.4.4","Give the personal information of vulnerable groups, eg children, extra protection in policies and procedures."]

{"sheet":"3. Training and awareness","index":7,"n_rows":22,"n_cols":10,"rows_kept":22,"cut":false,"hidden":false,"merged":[[20,1,21,1],[1,1,7,1],[1,0,7,0],[8,1,11,1],[12,1,15,1],[16,1,19,1],[8,0,11,0],[12,0,15,0],[16,0,19,0],[20,0,21,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.1","Incorporate national and sector-specific requirements in the training programme."]
[{"$f":"A2","v":3.1},"There is an all-staff data protection and information governance training programme.","3.1.2","Ensure the programme is comprehensive and includes training for all staff on key areas of data protection such as handling requests, data sharing, information security, personal data breaches and records management."]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.3","Consider the training needs of all staff and use this information to compile the training programme."]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.4","Assign responsibilities for managing information governance and data protection training across your organisation and have training plans or strategies in place to meet training needs within agreed time-scales."]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.5","Have dedicated and trained resources available to deliver training to all staff."]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.6","Regularly review the programme to ensure that it remains accurate and up to date."]
[3.1,"There is an all-staff data protection and information governance training programme.","3.1.7","Require senior management to sign off the programme."]
[3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.1","Ensure appropriate staff, such as the DPO or an information governance manager, oversee or approve induction training."]
[{"$f":"A9","v":3.2},"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.2","Deliver induction and refresher training to all staff, regardless of how long they will be working for your organisation, their contractual status or grade."]
[3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.3","Deliver induction training to all staff prior to accessing personal information and within one month of their start date."]
[3.2,"The training programme includes induction and refresher training for all staff on data protection and information governance.","3.2.4","Ensure staff complete refresher training at appropriate intervals."]
[3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.1","Complete a training needs analysis for information governance and data protection staff to inform the training plan and to ensure it is specific to their responsibilities."]
[{"$f":"A13","v":3.3},"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.2","Detail training and skills requirements in job descriptions."]
[3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.3","Have evidence to confirm that key roles complete up-to-date and appropriate specialised training and professional development, and are subject to proportionate refresher training."]
[3.3,"Specialised roles or functions with key data protection responsibilities (such as DPOs, subject access and records management teams) receive additional training and professional development beyond the basic level provided to all staff.","3.3.4","Keep on record copies of the training material provided as well as details of who received the training."]
[3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.1","Conduct an assessment at the end of the training to test staff understanding and make sure that it is effective, which could include a minimum pass mark."]
[{"$f":"A17","v":3.4},"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.2","Keep copies of the training material provided on record as well as details of who receives the training."]
[3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.3","Monitor training completion in line with organisational requirements at all levels of the organisation, and follow up with staff who do not complete the training."]
[3.4,"There is evidence to demonstrate that staff complete and understand the training and this is monitored appropriately through assessments or surveys.","3.4.4","Enable staff to provide feedback on the training they receive."]
[3.5,"Awareness is raised across the organisation of data protection, information governance and associated policies and procedures in meetings or staff forums. It is easy for staff to access relevant material.","3.5.1","Use a variety of appropriate methods to raise staff awareness and the profile of data protection and information governance, for example by emails, team briefings and meetings, posters, handouts and blogs."]
[{"$f":"A21","v":3.5},"Awareness is raised across the organisation of data protection, information governance and associated policies and procedures in meetings or staff forums. It is easy for staff to access relevant material.","3.5.2","Make it easy for staff to access relevant material, and find out who to contact if they have any queries relating to data protection and information governance."]

{"sheet":"4. Information rights","index":8,"n_rows":43,"n_cols":10,"rows_kept":43,"cut":false,"hidden":false,"merged":[[21,1,24,1],[9,1,12,1],[13,1,16,1],[1,1,3,1],[1,0,3,0],[4,0,8,0],[35,1,39,1],[40,1,42,1],[35,0,39,0],[40,0,42,0],[4,1,8,1],[17,1,20,1],[25,1,29,1],[21,0,24,0],[9,0,12,0],[13,0,16,0],[17,0,20,0],[25,0,29,0],[30,1,32,1],[33,1,34,1],[30,0,32,0],[33,0,34,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYY)"]
[4.0999999999999996,"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.1","Give people clear and relevant information about their rights and how to exercise them."]
[{"$f":"A2","v":4.0999999999999996},"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.2","Set out processes for dealing with requests from people about their rights in policies and procedures."]
[4.0999999999999996,"People are informed about their rights and all staff are aware of how to identify and deal with both verbal and written requests.","4.1.3","Deliver training and guidance to all staff on how to recognise a request and where to send them."]
[4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.1","Ensure there is a specific person or team in place that are responsible for managing and responding to requests."]
[{"$f":"A5","v":4.2},"There are appropriate resources in place to handle requests from people about their information.","4.2.2","Ensure staff receive specialised training to handle requests, including regular refresher training."]
[4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.3","Have sufficient resources to deal with requests."]
[4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.4","If a staff member is absent, train other staff to carry out key tasks."]
[4.2,"There are appropriate resources in place to handle requests from people about their information.","4.2.5","Ensure you can deal with any increase in requests or reduction in staffing levels."]
[4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.1","Put processes in place to ensure the log is accurate and updated as appropriate."]
[{"$f":"A10","v":4.3},"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.2","Show the due date for requests, the actual date of the final response and the action taken on the log."]
[4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.3","Have a checklist that records the key stages in the request handling process, eg which systems or departments have been searched. This could be part of the log or a separate document."]
[4.3,"Verbal and written requests from people are logged and the log is updated to track the handling of each request.","4.3.4","Keep records of your organisation's request responses, and any disclosed or withheld information."]
[4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.1","Action all requests within statutory timescales."]
[{"$f":"A14","v":4.4000000000000004},"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.2","Ensure staff responsible for managing requests meet regularly to discuss any issues and investigate, prioritise or escalate any delayed cases."]
[4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.3","If you need an extension, update people on the progress of their request and keep them informed."]
[4.4000000000000004,"Requests from people are dealt with in a timely manner that meets their expectations and statutory timescales.","4.4.4","If a request is refused, have records about the reasons why and inform people about the reasons for any refusals or exemptions."]
[4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.1","Ensure staff responsible for managing requests meet regularly to discuss any issues."]
[{"$f":"A18","v":4.5},"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.2","Produce regular reports on performance and case quality assessments to ensure that requests are handled appropriately."]
[4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.3","Share reports with senior management, that they review and action at appropriate meetings."]
[4.5,"There is monitoring in place on how staff handle requests and that information is used to make improvements.","4.5.4","Analyse any trends in the nature or cause of requests to improve performance or reduce volumes."]
[4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.1","Take proportionate and reasonable steps to check the accuracy of the personal information held and, if necessary, be able to rectify it."]
[{"$f":"A22","v":4.5999999999999996},"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.2","If your organisation is satisfied that the information is accurate, have a procedure to explain this to people. You need to inform  people of their right to complain, and as a matter of good practice, record on the system the fact that the person disputes the accuracy of the information."]
[4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.3","If personal information has been disclosed to others, contact each recipient to inform them about the rectification, unless this is impossible or involves disproportionate effort."]
[4.5999999999999996,"There are appropriate systems and procedures to change inaccurate information, add additional information to incomplete records or add a supplementary statement where necessary.","4.6.4","If asked, tell people which third parties have received their personal information."]
[4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.1","Erase personal information from back-up systems as well as live systems where necessary, and clearly tell people what will happen to their information."]
[{"$f":"A26","v":4.7},"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.2","If the personal information is disclosed to others, contact each recipient to inform them about the erasure, unless this is impossible or involves disproportionate effort."]
[4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.3","If asked to, tell people which third parties have received their personal information."]
[4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.4","If personal information has been made public in an online environment, take reasonable steps to tell other controllers, if they are processing it, to erase links to, copies or replication of that information."]
[4.7,"There are appropriate methods and procedures in place to delete, suppress or otherwise stop processing personal information if required.","4.7.5","Give particular weight to a request for erasure where the processing is or was based on a child’s consent, especially when processing any personal information on the internet."]
[4.8,"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.1","Restrict personal information in a way appropriate for the type of processing and the system, for example temporarily moving the information to another system or removing it from a website."]
[{"$f":"A31","v":4.8},"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.2","If the personal information has been disclosed to others, contact each recipient to tell them about the restriction, unless this is impossible or involves disproportionate effort."]
[4.8,"There are appropriate methods and procedures in place to restrict the processing of personal information if required.","4.8.3","If asked to, tell the requestor which third parties have received their personal information."]
[4.9000000000000004,"People are able to move, copy or transfer their personal information to another organisation securely, without affecting the information.","4.9.1","When requested, provide personal information in a structured, commonly used and machine readable format."]
[{"$f":"A34","v":4.9000000000000004},"People are able to move, copy or transfer their personal information to another organisation securely, without affecting the information.","4.9.2","Where possible and if a person requests it, directly transmit the information to another organisation."]
[4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.1","Complete additional checks for vulnerable groups, such as children, for all automated decision-making and profiling."]
[{"$f":"A36","v":4.0999999999999996},"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.2","Only collect the minimum information needed and have a clear retention policy for the profiles created."]
[4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.3","If your organisation uses solely automated decisions that have legal or similarly significant effects on people, have a recorded process to ensure these decisions only occur in accordance with article 22 of the UK GDPR. If this applies, carry out a data protection impact assessment (DPIA)."]
[4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.4","Where the decision is solely automated and has legal or similarly significant effects on people, ensure a recorded process allows simple ways for people to request human intervention, express their opinion and challenge a decision."]
[4.0999999999999996,"People’s rights related to automated decision-making and profiling are protected, particularly where the processing is solely automated with legal or similarly significant effects.","4.10.5","Conduct regular checks for accuracy and bias to ensure that systems are working as intended, and feed this back into the design process."]
[4.1100000000000003,"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.1","Implement procedures to handle data protection complaints raised by people and report their resolution to senior management."]
[{"$f":"A41","v":4.1100000000000003},"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.2","Make the DPO’s contact details or alternative contact points publicly available if people wish to raise a complaint about the use of their information."]
[4.1100000000000003,"There are procedures to recognise and respond to people's complaints about data protection, and people are made aware of their right to complain. ","4.11.3","Tell people about their right to make a complaint to the ICO in your privacy information."]

{"sheet":"5. Transparency","index":9,"n_rows":32,"n_cols":10,"rows_kept":32,"cut":false,"hidden":false,"merged":[[22,1,26,1],[27,1,31,1],[9,1,10,1],[1,1,8,1],[11,1,14,1],[15,1,18,1],[19,1,21,1],[1,0,8,0],[15,0,18,0],[19,0,21,0],[22,0,26,0],[27,0,31,0],[9,0,10,0],[11,0,14,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.1","Include all relevant contact information, eg the name and contact details of your organisation (and your representative if applicable) and the DPO’s contact details."]
[{"$f":"A2","v":5.0999999999999996},"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.2","Include the purposes of the processing and the lawful bases (and, if applicable, the legitimate interests for the processing)."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.3","Include the types of personal information you obtain and the information source, if the personal information is not obtained from the person it relates to."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.4","Include details of all personal information that you share with other organisations and, if applicable, details of transfers to any third countries or international organisations."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.5","Include retention periods for the personal information, or if that is not possible, the criteria used to determine the period."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.6","Include details about people’s rights including, if applicable, the right to withdraw consent and the right to make a complaint."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.7","Include details of whether people are under a statutory or contractual obligation to provide the personal information (if applicable, and if you collect the personal information from the person it relates to)."]
[5.0999999999999996,"Privacy information or notice includes all the required information under Article 13 and 14 of the UK GDPR.","5.1.8","Provide people with privacy information regarding the source of the personal information if you don’t obtain it from the person concerned, eg if the information is from publicly accessible sources such as social media, the open electoral register or Companies House."]
[5.2,"There is a recorded procedure to make sure that people receive privacy information at the right time, unless an exemption applies.","5.2.1","Provide people with privacy information when their information is collected (eg when they fill in a form) or by observation (eg when using CCTV or people are tracked online)."]
[{"$f":"A10","v":5.2},"There is a recorded procedure to make sure that people receive privacy information at the right time, unless an exemption applies.","5.2.2","If you obtain personal information from a source other than the person it relates to, provide privacy information to people, no later than one month after obtaining the information."]
[5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.1","Proactively make people aware of privacy information and ensure they have a free, easy way to access it."]
[{"$f":"A12","v":5.3},"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.2","Provide privacy information to people in electronic and hard-copy form, using a combination of appropriate techniques, such as a layered approach, icons and mobile and smart device functionalities."]
[5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.3","Write privacy information in clear and plain language that the intended audience can understand, and offer it in accessible formats if required."]
[5.3,"Privacy information is: \n• concise;\n• transparent; \n• intelligible; \n• clear; \n• uses plain language; and \n• communicated in a way that is effective for the target audience.","5.3.4","Take particular care to write privacy information for children in clear, plain language, that is age-appropriate, and explains the risks involved in the processing and what safeguards are in place."]
[5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.1","Implement procedures for people to access the personal information you use to create profiles, so they can review for accuracy and edit it if needed."]
[{"$f":"A16","v":5.4},"Processing relating to automated decision-making and profiling is transparent.","5.4.2","If the decision is solely automated and has legal or similarly significant effects, tell people about the processing - including what information you are using, why and what the impact is likely to be."]
[5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.3","If the purpose is initially unclear, give people an indication of what your organisation is going to do with their information, and proactively update your privacy information as this becomes clearer."]
[5.4,"Processing relating to automated decision-making and profiling is transparent.","5.4.4","If the decision is solely automated and has legal or similarly significant effects, explain the processing in a meaningful way that enables people to exercise their rights including obtaining human intervention, expressing their point of view and contesting the decision. "]
[5.5,"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.1","Arrange organisation-wide staff training about privacy information."]
[{"$f":"A20","v":5.5},"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.2","Ensure front-line staff receive more specialised or specific training."]
[5.5,"Front-line staff are able to explain the necessary privacy information to people and provide guidance.","5.5.3","Make staff aware of the various ways in which the organisation provides privacy information."]
[5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.1","Review privacy information against the records of processing activities, to ensure it remains up to date and that it accurately explains what happens with peoples personal information."]
[{"$f":"A23","v":5.6},"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.2","Maintain a log of historical privacy notices, including the dates you made any changes, in order to allow a review of what privacy information you provided to people and when."]
[5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.3","Carry out user testing to evaluate the privacy information’s effectiveness."]
[5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.4","Analyse complaints from the public about how you use their personal information, and in particular, any complaints about how you explain that use."]
[5.6,"There are procedures in place to review the privacy information provided to people regularly to make sure that it is accurate, up to date and effective.","5.6.5","If your organisation plans to use personal information for a new purpose, implement a procedure to update the privacy information and communicate the changes to people before starting any new processing."]
[5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.1","Ensure privacy policies are clear and easy for members of the public to access."]
[{"$f":"A28","v":5.7},"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.2","Provide people with tools, such as secure self-service systems, dashboards and just-in-time notices, so they can access, determine and manage how your organisation uses their personal information."]
[5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.3","Offer strong privacy defaults and user-friendly options and controls."]
[5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.4","Where relevant, have processes in place to help children exercise their data protection rights in an easily accessible way that they understand."]
[5.7,"There is openness about how personal information is used, and tools are available to support transparency and control, especially when processing children's personal information. ","5.7.5","Implement appropriate measures to protect children using digital services."]

{"sheet":"6 ROPA and lawful basis","index":10,"n_rows":34,"n_cols":10,"rows_kept":34,"cut":false,"hidden":false,"merged":[[1,0,3,0],[4,0,6,0],[7,0,8,0],[1,1,3,1],[4,1,6,1],[7,1,8,1],[22,1,24,1],[25,1,28,1],[29,1,33,1],[10,0,15,0],[10,1,15,1],[16,1,18,1],[19,1,21,1],[25,0,28,0],[29,0,33,0],[16,0,18,0],[19,0,21,0],[22,0,24,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[6.1,"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.1","Carry out information audits (or data mapping exercises) to find out what personal information is held and to understand how the information flows through your organisation."]
[{"$f":"A2","v":6.1},"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.2","Keep the data map up to date and clearly assign the responsibilities for maintaining and amending it."]
[6.1,"Comprehensive data mapping exercises are carried out, providing a clear understanding of what information is held and where.","6.1.3","Consult staff to make sure that there is an accurate picture of processing activities, for example by using questionnaires and staff surveys."]
[6.2,"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.1","Record processing activities in electronic form so you can add, remove and amend information easily."]
[{"$f":"A5","v":6.2},"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.2","Review the record against processing activities, policies and procedures to ensure that it remains accurate and up to date, and clearly assign responsibilities for doing this."]
[6.2,"There is a formal, documented, comprehensive and accurate record of all processing activities (ROPA) based on a data mapping exercise that is reviewed regularly.","6.2.3","Regularly review the processing activities and types of information you process for data minimisation purposes."]
[6.3,"The ROPA contains all the relevant requirements set out in Article 30 of the UK GDPR.","6.3.1","Ensure the ROPA includes (as a minimum):\n• Your organisation's name and contact details, whether it is a controller or a processor (and where applicable, the joint controller, their representative and the DPO);\n• the purposes of the processing;\n• a description of the categories of people and personal data;\n• the categories of recipients of personal data;\n• details of transfers to third countries, including a record of the transfer mechanism safeguards in place;\n• retention schedules; and\n• a description of the technical and organisational security measures in place."]
[{"$f":"A8","v":6.3},"The ROPA contains all the relevant requirements set out in Article 30 of the UK GDPR.","6.3.2","Document an internal record of all processing activities carried out by any processors on behalf of your organisation."]
[6.4,"The ROPA includes links to other relevant documentation, such as contracts or records as a matter of good practice.","6.4.1","The ROPA also includes, or links to documentation covering:\n• information required for privacy notices, such as the lawful basis for the processing and the source of the personal data;\n• records of consent;\n• controller-processor contracts;\n• the location of personal data;\n•  DPIA reports;\n• records of personal data breaches;\n• information required for processing special category data or criminal conviction and offence data under the Data Protection Act 2018 (DPA 2018); and\n• retention and erasure policy documents."]
[6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.1","Select the most appropriate lawful basis (or bases) for each activity following a review of the processing purposes."]
[{"$f":"A11","v":6.5},"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.2","Document the lawful basis (or bases) relied upon and the reasons why."]
[6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.3","If your organisation processes special category or criminal offence data, identify and document a lawful basis for general processing and an additional condition for processing this type of information (or in the case of criminal offence data, identify the official authority to process)."]
[6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.4","In the case of special category or criminal offence data, document consideration of the requirements of Article 9 or 10 of the UK GDPR and Schedule 1 of the DPA 2018 where relevant."]
[6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.5","Where Schedule 1 requires it, have an appropriate policy document including:\n• which Schedule 1 conditions you are relying upon;\n• what procedures you have in place to ensure compliance with the data protection principle;\n• how you will treat special category or criminal offence data for retention and erasure purposes;\n• a review date; and\n• details of the person assigned responsibility for the processing."]
[6.5,"The lawful basis for processing personal information is documented and appropriately justified in line with Article 6 of the UK GDPR (and Articles 9 and 10, if the processing involves special category or criminal offence data).","6.5.6","Identify the lawful basis before starting any new processing."]
[6.6,"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.1","Make information about the purposes of the processing, your lawful basis and relevant conditions for processing any special category or criminal offence data publicly available in your organisation's privacy notice(s)."]
[{"$f":"A17","v":6.6},"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.2","Provide information in an easily understandable format."]
[6.6,"Information about the purpose of the processing and the lawful basis is made publicly available. This is easy to locate, access and read.","6.6.3","If there is a genuine change in circumstances, or if your lawful basis must change due to a new and unanticipated purpose, inform people in a timely manner and record the changes."]
[6.7,"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.1","Ensure consent requests: \n• are kept separate from other terms and conditions; \n• require a positive opt-in and do not use pre-ticked boxes; \n• are clear and specific (not a pre-condition of signing up to a service); \n• inform people how to withdraw consent in an easy way; and \n• give your organisation's name as well as the names of any third parties relying on consent."]
[{"$f":"A20","v":6.7},"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.2","Record what a person has consented to, including what they were told and when and how they consented. Ensure the records are thorough and easy for relevant staff to access, review and withdraw if required."]
[6.7,"When relying on consent for the processing of personal data, the consent mechanism is: \n• specific; \n• granular; \n• prominent; \n• opt-in; \n• documented; and \n• easily withdrawn. ","6.7.3","Have evidence and examples of how consent is sought from people, for example online forms or notices, opt-in tick boxes or paper-based forms."]
[6.8,"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.1","Have a procedure in place to review consents to check that the relationship, the processing and the purposes have not changed and to record any changes."]
[{"$f":"A23","v":6.8},"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.2","Have a procedure in place to refresh consent at appropriate intervals."]
[6.8,"There is a proactive review of records of previously gathered consent, which demonstrates a commitment to confirming and refreshing the consents.","6.8.3","Use privacy dashboards or other preference management tools to help people manage their consent."]
[6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.1","Make reasonable efforts to check the age of those giving consent, particularly where the person is a child."]
[{"$f":"A26","v":6.9},"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.2","Ensure you have a reasonable and effective procedure to determine whether the person in question can provide their own consent, and if not, an effective way to gain and record parental or guardian consent."]
[6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.3","When providing online services to children, ensure there are risk-based age checking systems in place to establish age, with an appropriate level of certainty based on the risks to children's rights and freedoms."]
[6.9,"There are effective systems in place to conduct risk-based age checks and, where required, to obtain and record parental or guardian consent.","6.9.4","When providing online services to children, if the child is under 13, have records of parental or guardian consent which are regularly reviewed, and make reasonable efforts to verify that the person giving consent has parental responsibility. Give particular consideration when a child reaches the age of 13 and is able to provide their own consent."]
[6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.1","Ensure the LIA identifies the legitimate interest, the benefits of the processing and whether it is necessary."]
[{"$f":"A30","v":6.1},"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.2","Include a 'balancing test' to show how your organisation determines that its legitimate interests override the person's interests and consider the following issues:\n• not using people's data in intrusive ways or in ways which could cause harm, unless there is a very good reason;\n• protecting the interests of vulnerable groups such as people with learning disabilities or children;\n• whether you could introduce safeguards to reduce any potentially negative impact;\n• whether you could offer an opt-out; and\n• whether you require a DPIA."]
[6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.3","Clearly document the decision and the assessment."]
[6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.4","Complete the LIA prior to the start of the processing."]
[6.1,"Where the lawful basis is legitimate interests, a legitimate interests assessment (LIA) has been completed prior to starting the processing.","6.10.5","Keep the LIA under review and refresh it if changes affect the outcome."]

{"sheet":"7. Contracts and data sharing","index":11,"n_rows":32,"n_cols":10,"rows_kept":32,"cut":false,"hidden":false,"merged":[[13,0,19,0],[1,1,4,1],[5,1,10,1],[11,1,12,1],[13,1,19,1],[1,0,4,0],[5,0,10,0],[11,0,12,0],[30,0,31,0],[20,0,23,0],[24,0,26,0],[27,0,28,0],[27,1,28,1],[30,1,31,1],[24,1,26,1],[20,1,23,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.1","Implement a review process, through a DPIA or a similar exercise, to assess the legality, benefits and risks of the data sharing."]
[{"$f":"A2","v":7.1},"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.2","Document all sharing decisions for audit, monitoring and investigation purposes and regularly review them."]
[7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.3","Have clear policies, procedures and guidance about data sharing, including who has the authority to make decisions about systematic data sharing or one-off disclosures, and when it is appropriate to do so."]
[7.1,"There are policies and procedures in place to make sure that data sharing decisions are appropriately managed.","7.1.4","Train all staff likely to make decisions about data sharing, and makes them aware of their responsibilities. Refresh this training appropriately."]
[7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.1","Agree data sharing agreements with all the relevant parties and ensure senior management sign them off."]
[{"$f":"A6","v":7.2},"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.2","Ensure the data sharing agreement includes details about: \n• the parties' roles;\n• the purpose of the data sharing; \n• what is going to happen to the data at each stage; and \n• sets standards (with a high privacy default for children)."]
[7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.3","Where necessary, implement procedures and guidance covering each organisation’s day-to-day operations to support the agreements."]
[7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.4","If your organisation is acting as a joint controller (within the meaning of Article 26 of the UK GDPR), set out responsibilities under an arrangement or a data sharing agreement and provide appropriate privacy information to people."]
[7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.5","Have a regular review process to make sure that the information remains accurate and up to date, and to examine how the agreement is working."]
[7.2,"There are data sharing agreements in place with parties with whom personal information is routinely shared. The agreements are reviewed regularly.","7.2.6","Keep a central log of the current sharing agreements"]
[7.3,"There are procedures in place to make sure that restricted transfers are made appropriately.","7.3.1","Consider whether the restricted transfer is covered by an adequacy decision or by 'appropriate safeguards' listed in data protection law, such as contracts incorporating standard contractual data protection clauses adopted by the Commission or Binding Corporate Rules (BCRs)."]
[{"$f":"A12","v":7.3},"There are procedures in place to make sure that restricted transfers are made appropriately.","7.3.2","If a restricted transfer is not covered by an adequacy decision nor an appropriate safeguard, consider whether it is covered by an exemption set out in Article 49 of the UK GDPR."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.1","Ensure there are written contracts with all processors."]
[{"$f":"A14","v":7.4},"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.2","If using a processor, assess the risk to people and make sure that these risks are mitigated effectively."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.3","Ensure an appropriate level of management approves the contracts and both parties sign. The level of management required for approval should be proportionate to the value and risk of the contract."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.4","Ensure each contract (or other legal act) sets out details of the processing, including the:\n•  subject matter of the processing;\n•  duration of the processing;\n•  nature and purpose of the processing;\n•  type of personal information involved;\n•  categories of people; and\n•  controller’s obligations and rights, in accordance with the list set out in Article 28(3) of the UK GDPR."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.5","Keep a record or log of all current processor contracts, and update it when processors change."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.6","Review contracts periodically to make sure they remain up to date."]
[7.4,"There are appropriate procedures in place regarding the work that processors do on behalf of the organisation.","7.4.7","If a processor uses a sub-processor to help with the processing it is doing on your behalf, ensure they have written authorisation from your organisation and a written contract with that sub-processor."]
[7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.1","Ensure the contract or other legal act includes terms or clauses stating that the processor must:\n• only act on the controller’s documented instructions, unless required by law to act without such instructions;\n• ensure that people processing the data are subject to a duty of confidence;\n• help the controller respond to requests from people to exercise their rights; and\n• submit to audits and inspections."]
[{"$f":"A21","v":7.5},"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.2","Contracts include the technical and organisational security measures the processor will adopt (including encryption, pseudonymisation, resilience of processing systems and backing up personal data in order to be able to reinstate the system)."]
[7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.3","The contract inlcudes clauses to make sure that the processor either deletes or returns all personal data to the controller at the end of the contract. The processor must also delete existing personal data unless the law requires its storage."]
[7.5,"All controller-processor contracts cover the terms and clauses necessary to comply with data protection law.","7.5.4","Clauses are included to make sure that the processor assists the controller in meeting its UK GDPR obligations regarding the security of processing, the notification of personal data breaches and DPIAs. "]
[7.6,"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.1","Build in due diligence checks into the procurement process that are proportionate to the risk of the processing before you agree a contract with a processor."]
[{"$f":"A25","v":7.6},"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.2","Ensure the due diligence process includes data security checks, eg site visits, system testing and audit requests."]
[7.6,"Due diligence checks are carried out to guarantee that processors will implement appropriate technical and organisational measures to meet UK GDPR requirements.","7.6.3","Ensure the due diligence process includes checks to confirm a potential processor will protect people’s rights."]
[7.7,"There is a review of data processors’ compliance with their contracts.","7.7.1","Ensure contracts include clauses to allow your organisation to conduct audits or checks, to confirm the processor is complying with all contractual terms and conditions."]
[{"$f":"A28","v":7.7},"There is a review of data processors’ compliance with their contracts.","7.7.2","Carry out routine compliance checks, proportionate to the processing risks, to test that processors are complying with contractual agreements."]
[7.8,"There is evidence that ‘data protection by design’ is considered when selecting services and products to use in data processing activities.","7.8.1","When third parties supply products or services to process personal information, choose suppliers that design their products or services with data protection in mind."]
[7.9,"There are proactive steps taken to only share necessary personal information with processors or other third parties.","7.9.1","Only share the personal information necessary to achieve your specific purpose."]
[{"$f":"A31","v":7.9},"There are proactive steps taken to only share necessary personal information with processors or other third parties.","7.9.2","When information is shared, ensure it is pseudonymised or minimised wherever possible. Consider anonymisation so that the information is no longer personal information."]

{"sheet":"8. Risks and DPIAs","index":12,"n_rows":30,"n_cols":10,"rows_kept":30,"cut":false,"hidden":false,"merged":[[1,0,6,0],[7,0,9,0],[10,0,16,0],[17,0,23,0],[24,0,29,0],[1,1,6,1],[7,1,9,1],[10,1,16,1],[17,1,23,1],[24,1,29,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.1","Set out how your organisation and its data processors manage information risk in an information risk policy (either a separate document or part of a wider corporate risk policy), and decide how you monitor compliance with the information risk policy."]
[{"$f":"A2","v":8.1},"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.2","Have a process to help staff report and escalate information governance or data protection concerns and risks to a central point, for example staff forums."]
[8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.3","Identify and manage information risks in an appropriate risk register, which includes clear links between corporate and departmental risk registers and the risk assessment of information assets."]
[8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.4","Have formal procedures to identify, record and manage risks associated with information assets in an information asset register."]
[8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.5","If you identify information risks, have appropriate action plans, progress reports and consider the lessons learnt to avoid future risk."]
[8.1,"There are appropriate policies, procedures and measures to identify, record and manage information risks.","8.1.6","Put measures in place to mitigate the risks identified within risk categories, and test these regularly to make sure that they remain effective."]
[8.1999999999999993,"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.1","Reference DPIA requirements in all risk, project and change management policies and procedures, with links to DPIA policies and procedures."]
[{"$f":"A8","v":8.1999999999999993},"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.2","Ensure procedures state that, if required, a DPIA should begin at the project's outset, before processing starts, and that the DPIA must run alongside the planning and development process."]
[8.1999999999999993,"There is a data protection by design and by default approach to managing risks, and, as appropriate, DPIA requirements are built into policies and procedures.","8.2.3","Anticipate risks and privacy-invasive events before they occur, making sure that at the initial design phase of any system, product or process and throughout, you consider the: \n• intended processing activities;\n• risks that these may pose to the rights and freedoms of people; and\n• possible measures available to mitigate the risks."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.1","Have a DPIA policy which includes:\n•  clear procedures to decide whether you conduct a DPIA; \n•  what the DPIA should cover;\n•   who will authorise it; and\n•  how you will incorporate it into the overall planning."]
[{"$f":"A11","v":8.3000000000000007},"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.2","Have a screening checklist to consider if you need a DPIA, including all the relevant considerations on the scope, type and manner of the proposed processing."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.3","If the screening checklist indicates that you do not need a DPIA, document this."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.4","Ensure your procedure includes the requirement to seek advice from the DPO and other internal staff as appropriate."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.5","Ensure your procedure includes consultation with controllers,  processors, people, their representatives and any other relevant stakeholders as appropriate."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.6","Include the need to consider a DPIA at the early stages of any plan involving personal information in your training and, where relevant, train staff in how to carry out a DPIA."]
[8.3000000000000007,"There is understanding of whether a DPIA is required, or where it would be good practice to complete one. There is a clear DPIA policy and procedure.","8.3.7","Assign responsibility for completing DPIAs to a member of staff, who has enough authority over a project to effect change, eg a project lead or manager."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.1","Implement a standard, well-structured DPIA template which is written in plain English."]
[{"$f":"A18","v":8.4},"DPIAs always include the appropriate information and are comprehensively documented.","8.4.2","Ensure DPIAs:\n•  include the nature, scope, context and purposes of the processing;\n•  assess necessity, proportionality and compliance measures;\n•  identify and assess risks to people; and \n•  identify any additional measures to mitigate those risks."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.3","Ensure DPIAs clearly set out the relationships and data flows between controllers, processors, people and systems."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.4","Ensure DPIAs identify measures that eliminate, mitigate or reduce high risks."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.5","Have a documented process, with appropriate document controls, that is reviewed periodically to ensure it remains up to date."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.6","Record your DPO’s advice and recommendations and the details of any other consultations."]
[8.4,"DPIAs always include the appropriate information and are comprehensively documented.","8.4.7","Ensure appropriate people sign off DPIAs, such as a project lead or senior manager."]
[8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.1","Have a procedure to consult the ICO if you cannot mitigate residual high risks."]
[{"$f":"A25","v":8.5},"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.2","Integrate outcomes from DPIAs into relevant work plans, project action plans and risk registers."]
[8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.3","Do not start high risk processing until mitigating measures are in place following the DPIA."]
[8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.4","Have a procedure to communicate the outcomes of DPIAs to appropriate stakeholders, eg through a formal summarised report."]
[8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.5","Consider actively publishing DPIAs where possible, removing sensitive details if necessary."]
[8.5,"There are appropriate and effective actions taken to mitigate or manage any risks a DPIA identifies, and there is a DPIA review process.","8.5.6","Agree and document a schedule for reviewing the DPIA regularly or when the nature, scope, context or purposes of the processing changes."]

{"sheet":"9. Records management and sec..","index":13,"n_rows":64,"n_cols":10,"rows_kept":64,"cut":false,"hidden":false,"merged":[[12,0,15,0],[16,0,20,0],[21,1,23,1],[24,1,26,1],[12,1,15,1],[16,1,20,1],[21,0,23,0],[24,0,26,0],[1,0,4,0],[5,0,8,0],[9,0,11,0],[1,1,4,1],[5,1,8,1],[9,1,11,1],[27,0,31,0],[27,1,31,1],[60,0,63,0],[32,0,45,0],[46,0,51,0],[52,0,59,0],[60,1,63,1],[32,1,45,1],[46,1,51,1],[52,1,59,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.1","Implement policies and procedures to ensure that you appropriately classify, title and index new records in a way that facilitates management, retrieval and disposal."]
[{"$f":"A2","v":9.1},"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.2","Identify where you use manual and electronic record-keeping systems and maintain a central log or information asset register."]
[9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.3","Know the whereabouts of records at all times, track their movements, and make attempts to trace records that are missing or not returned."]
[9.1,"There are minimum standards for the creation of records and effective mechanisms to locate and retrieve records.","9.1.4","Index records stored off-site with unique references to enable accurate retrieval and subsequent tracking."]
[9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.1","Document rules to protect the internal and external transfer of records by post, fax and electronically, for example in a transfer policy or guidance."]
[{"$f":"A6","v":9.1999999999999993},"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.2","Minimise information transferred off-site and keep it secure in transit."]
[9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.3","When you transfer information off site, use an appropriate form of transport (for example secure courier, encryption, secure file transfer protocol (SFTP) or Virtual Private Network (VPN)) and make checks to ensure the information has been received."]
[9.1999999999999993,"There are appropriate security measures in place to protect information that is in transit, information received or information transferred to another organisation.","9.2.4","Have agreements in place with any third parties used to transfer business information between your organisation and third parties."]
[9.3000000000000007,"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.1","Conduct regular data quality reviews of records containing personal information to make sure they are accurate, adequate and not excessive."]
[{"$f":"A10","v":9.3000000000000007},"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.2","Make staff aware of data quality issues following data quality checks or audits to prevent recurrence."]
[9.3000000000000007,"There are procedures in place to make sure that records containing personal information are accurate, adequate and not excessive.","9.3.3","Weed records containing personal information (whether active or archived) periodically to reduce the risks of inaccuracies and excessive retention."]
[9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.1","Have a retention schedule based on business need with reference to statutory requirements and other principles (for example the National Archives)."]
[{"$f":"A13","v":9.4},"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.2","Ensure the schedule provides sufficient information to identify all records and to implement disposal decisions in line with the schedule."]
[9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.3","Assign responsibilities to make sure that staff adhere to the schedule and you review it regularly."]
[9.4,"There is an appropriate retention schedule outlining storage periods for all personal information, which is reviewed regularly.","9.4.4","Regularly review retained information to identify opportunities for minimisation, pseudonymisation or anonymisation and document this in the schedule."]
[9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.1","For paper documents, use locked waste bins for records containing personal information, and either in-house or third party cross shredding or incineration is in place."]
[{"$f":"A17","v":9.5},"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.2","For information held on electronic devices, wiping, degaussing or secure destruction of hardware (shredding) is in place."]
[9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.3","Hold, collect or send away securely confidential waste awaiting destruction."]
[9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.4","Have appropriate contracts in place with third parties to dispose of personal information, that provide you with appropriate assurance that they have securely disposed of the information, for example through audit checks and destruction certificates."]
[9.5,"Methods of destruction are covered in a policy and they are appropriate to prevent disclosure of personal information prior to, during or after disposal.","9.5.5","Have a log of all equipment and confidential waste sent for disposal or destruction."]
[9.6,"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.1","Have an asset register that holds details of all information assets (software and hardware) including: \n• asset owners; \n• asset location; \n• retention periods; and \n• security measures deployed."]
[{"$f":"A22","v":9.6},"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.2","Review the register periodically to make sure it remains up to date and accurate."]
[9.6,"There is an asset register that records assets, systems and applications used for processing or storing personal information across the organisation.","9.6.3","Periodically risk-assess assets within the register and have physical checks to make sure that the hardware asset inventory remains accurate."]
[9.6999999999999993,"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.1","Have acceptable use or terms and conditions of use procedures in place."]
[{"$f":"A25","v":9.6999999999999993},"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.2","Have system operating procedures which document the security arrangements and measures in place to protect the information held within systems or applications."]
[9.6999999999999993,"Identify, document and implement rules for the acceptable use of software (systems or applications) processing or storing information.","9.7.3","Monitor compliance with acceptable use rules and make sure that staff are aware of any monitoring."]
[9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.1","Have an access control policy which specifies that users must follow your organisation's practices in the use of secret authentication information, for example passwords or tokens."]
[{"$f":"A28","v":9.8000000000000007},"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.2","Implement a formal user access provisioning procedure to assign access rights for staff (including temporary staff) and third-party contractors to all relevant systems and services required to fulfil their role, for example 'new starter process'."]
[9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.3","Restrict and control the allocation and use of privileged access rights."]
[9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.4","Keep a log of user access to systems holding personal information."]
[9.8000000000000007,"Access to personal information is limited to authorised staff only and users’ access rights are regularly reviewed.","9.8.5","Regularly review users’ access rights and adjust or remove rights where appropriate, for example when an employee changes role or leaves the organisation."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.1","Restrict access to systems or applications processing personal information to the absolute minimum in accordance with the principle of least privilege (for example read/write/delete/execute access rules are applied)."]
[{"$f":"A33","v":9.9},{"$f":"B33","v":"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools."},"9.9.2","Apply minimum password complexity rules and limited log on attempts to systems or applications processing personal information."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.3","Have password management controls in place, including default password changing, controlled use of any shared passwords and secure password storage (not in plain text)."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.4","Use email content and attachment security solutions (encryption) to appropriately protect emails containing sensitive personal information."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.5","Log and monitor user and system activity to detect anything unusual."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.6","Implement anti-malware and anti-virus (AV) protection across the network and on critical or sensitive information systems if appropriate."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.7","Keep anti-malware and anti-virus protection iup-to-date and configure it to perform regular scans."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.8","Ensue your organisation has access to and acts upon any updates on technical vulnerabilities to systems or software, for example vendor’s alerts or patches."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.9","Regularly run vulnerability scans."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.10","Deploy URL or web content filtering to block specific websites or entire categories."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.11","Strictly control or prohibit the use of social media, or messaging apps such as WhatsApp to share personal information."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.12","Have external and internal firewalls and intrusion detection systems in place as appropriate to ensure the security of information in networks and systems from unauthorised access or attack, for example denial of service attacks."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.13","Do not have unsupported operating systems in use, for example Windows XP or Windows Server 2003."]
[9.9,"Unauthorised access to systems and applications is prevented, for example by passwords, technical vulnerability management and malware prevention tools.","9.9.14","Establish special controls to safeguard the confidentiality and integrity of information passing over public networks or over wireless networks and to protect the connected systems and applications."]
[9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.1","Have a mobile device and a home/remote working policy that demonstrates how your organisation will manage the associated security risks."]
[{"$f":"A47","v":9.1},"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.2","Have protections in place to avoid the unauthorised access to or disclosure of the information processed by mobile devices, for example, encryption and remote wiping capabilities."]
[9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.3","Implement security measures to protect information processed when home or remote working, for example VPN and two-factor authentication."]
[9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.4","Where you have a business need to store personal information on removable media, minimise personal information and implement a software solution that can set permissions or restrictions for individual devices as well as an entire class of devices."]
[9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.5","Use the most up-to-date version of your remote access solution. Support and update devices remotely."]
[9.1,"There are appropriate mechanisms in place to manage the security risks of using mobile devices, home or remote working and removable media.","9.10.6","Do not allow equipment, information or software to be taken off-site without prior authorisation and have a log of all mobile devices and removable media used and who they are allocated to."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.1","Protect secure areas (areas that contain either sensitive or critical information) by appropriate entry controls such as doors and locks, alarms, security lighting or CCTV."]
[{"$f":"A53","v":9.11},"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.2","Have visitor protocols in place such as signing-in procedures, name badges and escorted access."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.3","Implement additional protection against external and environmental threats in secure areas such as server rooms."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.4","Ensure office equipment is appropriately placed and protected to reduce the risks from environmental threats and opportunities for unauthorised access."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.5","Securely store paper records and control access to them."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.6","Operate a clear desk policy across your organisation where personal information is processed."]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.7","Have regular clear desk 'sweeps' or checks and issues are fed back appropriately"]
[9.11,"Physical business locations are secured to prevent unauthorised access, damage and interference to personal information.","9.11.8","Operate a 'clear screen' policy across your organisation where personal information is processed."]
[9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.12.1","Have a risk-based Business Continuity Plan to manage disruption and a Disaster Recovery Plan to manage disasters, which identify records that are critical to the continued functioning of your organisation."]
[{"$f":"A61","v":9.1199999999999992},"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.12.2","Take back-up copies of electronic information, software and systems (and ideally store them off-site)."]
[9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.13.3","Ensure the frequency of backups reflects the sensitivity and importance of the information."]
[9.1199999999999992,"There are plans to deal with serious disruption, and back up key systems, applications and information to protect against loss of personal information.","9.13.4","Regularly test back-ups and recovery processes to ensure they remain fit for purpose."]

{"sheet":"10. Breach response and monitor","index":14,"n_rows":39,"n_cols":10,"rows_kept":39,"cut":false,"hidden":false,"merged":[[16,0,19,0],[20,1,24,1],[16,1,19,1],[1,0,7,0],[8,0,11,0],[12,0,15,0],[1,1,7,1],[8,1,11,1],[12,1,15,1],[36,0,38,0],[20,0,24,0],[25,0,31,0],[32,0,35,0],[25,1,31,1],[32,1,35,1],[36,1,38,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.1","Have appropriate training in place so that staff are able to recognise a security incident and a personal data breach."]
[{"$f":"A2","v":10.1},"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.2","Appoint a dedicated person or team to manage security incidents and personal data breaches."]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.3","Ensure staff know how to escalate a security incident promptly to the appropriate person or team to determine whether a breach has occurred."]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.4","Ensure procedures and systems facilitate the reporting of security incidents and breaches."]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.5","Implement a response plan for promptly addressing any security incidents and personal data breaches that occur."]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.6","Centrally log, record and document both actual breaches and near misses (even if they do not need to be reported to the ICO or people)."]
[10.1,"There are procedures in place to make sure that personal data incidents and breaches are detected, managed and appropriately recorded. ","10.1.7","Documents in the log the facts relating to the near miss or breach including: \n• its causes; \n• what happened; \n• the personal data affected; \n• the effects of the breach; and \n• any remedial action taken and rationale."]
[10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.1","Have a procedure to assess the likelihood and severity of the risk to people as a result of a personal data breach."]
[{"$f":"A9","v":10.199999999999999},"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.2","Have a procedure to notify the ICO of a breach within 72 hours of becoming aware of it (even when all the information is not yet available) and notify the ICO on time."]
[10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.3","Ensure the procedure includes details of what information must be given to the ICO about the breach."]
[10.199999999999999,"There are procedures to assess all security incidents and then report relevant breaches to the ICO within the statutory time frame.","10.2.4","If you consider it unnecessary to report a breach, document the reasons why your organisation considers the breach unlikely to result in a risk to the rights and freedoms of people."]
[10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.1","Have a procedure setting out how you will tell affected people about a breach when it is likely to result in a high risk to their rights and freedoms."]
[{"$f":"A13","v":10.3},"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.2","Tell people about personal data breaches in clear, plain language without undue delay"]
[10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.3","Ensure the information you provide to people includes the DPO’s details, a description of the likely consequences of the breach and the measures taken (including mitigating actions and any possible adverse effects)."]
[10.3,"There are procedures to notify affected people where the breach is likely to result in a high risk to their rights and freedoms.","10.3.4","Provide people with advice to protect themselves from any effects of the breach."]
[10.4,"Personal data breaches are reviewed and monitored.","10.4.1","Analyse all personal data breach reports to prevent a recurrence."]
[{"$f":"A17","v":10.4},"Personal data breaches are reviewed and monitored.","10.4.2","Monitor the type, volume and cost of incidents."]
[10.4,"Personal data breaches are reviewed and monitored.","10.4.3","Undertake trend analysis on breach reports over time to understand themes or issues."]
[10.4,"Personal data breaches are reviewed and monitored.","10.4.4","Ensure groups with oversight for data protection and information governance review the outputs."]
[10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.1","Complete externally-provided self-assessment tools to provide assurances on data protection and information security compliance."]
[{"$f":"A21","v":10.5},"There are external data protection and information governance audits or other compliance checking procedures.","10.5.2","Ensure your organisation is subject to or employs the services of an external auditor to provide independent assurances (or certification) on data protection and information security compliance."]
[10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.3","Adhere to an appropriate code of conduct or practice for your sector (if one exists)."]
[10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.4","Produce audit reports to document the findings."]
[10.5,"There are external data protection and information governance audits or other compliance checking procedures.","10.5.5","Have a central action plan in place to take forward the outputs from data protection and information governance audits."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.1","Monitor your own data protection compliance and regularly test the effectiveness of the measures you have in place."]
[{"$f":"A26","v":10.6},"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.2","Regularly test staff adherence to data protection and information governance policies and procedures."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.3","Routinely conduct informal ad-hoc monitoring and spot checks."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.4","Ensure your monitoring of policy compliance is unbiased by keeping it separate from those who implement the policies."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.5","Have a central audit plan/schedule in place to show the planning of data protection and information governance internal audits."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.6","Produce audit reports to document the findings."]
[10.6,"There is an internal audit programme, covering data protection and related information governance (for example security and records management) in sufficient detail.","10.6.7","Have a central action plan in place to take forward the outputs from data protection and information governance audits."]
[10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.1","Have KPIs regarding subject access request (SAR) performance (the volume of requests and the percentage completed within statutory timescales)."]
[{"$f":"A33","v":10.7},"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.2","Have KPIs regarding the completion of data protection and information governance training, including a report showing the percentage of staff who complete training."]
[10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.3","Have KPIs regarding information security, including the number of security breaches, incidents and near misses."]
[10.7,"There are business targets relating to data protection compliance and information governance, and access to the relevant information to assess against them.","10.7.4","Have KPIs regarding records management, including the use of metrics such as file retrieval statistics, adherence to disposal schedules and the performance of the system in place to index and track paper files containing personal information."]
[10.8,"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.1","Have a dashboard giving a high-level summary of all key data protection and information governance KPIs."]
[{"$f":"A37","v":10.8},"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.2","Regularly discuss KPIs and the outcomes of monitoring and reviews at the group(s) providing oversight of data protection and information governance."]
[10.8,"Relevant management information and the outcomes of monitoring and review activity are communicated to relevant internal stakeholders, including senior management as appropriate. This information informs discussions and actions.","10.8.3","Discuss data protection and information governance KPIs and the outcomes of monitoring and reviews at groups at operational level, for example in team meetings."]