{"text_format":"1","workbook":"xlsx","n_sheets":15,"sheets":["Introduction","Dashboard","Master sheet","Tables & graphs","Lookup","1. Records management framework","2. Data collection","3. Record creation ","4. Data mapping and recording","5. Access","6. Movement and retrieval","7. Maintenance and accuracy","8. Retention","9. Diposal and deletion","10. Right to be forgotten"],"not_rendered":{"charts":12,"images":1,"macros":1,"external_links":0,"defined_names":11,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"Records Management Toolkit Tracker"]
[null,"\nYou can use this Tracker to record and track your actions once you have read the toolkit. \n\nThe first tab is called ‘Dashboard’. The dashboard will update automatically when you fill in the spreadsheet.\n\nThe next tab is called ‘Master Sheet’. This shows the toolkit and records all your responses in one place.\n\nWe have suggested some columns to help you to build your own action plan and improve your compliance. However, as the spreadsheet contains formula we would not recommend altering any of the existing columns. If you do make changes, you may impact the dashboard, master sheet or general functionality. Please note that we cannot offer support for maintaining the spreadsheet.\n\nKey phrases:\n\nCurrent status – This refers to whether you are ‘fully meeting our expectation’, ‘partially meeting our expectation’, or ‘not meeting our expectation’. You can also record the status as ‘not applicable’ to your organisation. You can choose the status from a drop-down list.\n\nReasons for status – You can record the reasons why you have chosen the ‘Current status’ for this expectation.\n\nActions – You can describe what you need to do next to meet the expectation.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\n\nThe Data Protection Audit Tracker, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Dashboard","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Master sheet","index":2,"n_rows":131,"n_cols":16,"rows_kept":131,"cut":false,"hidden":false,"merged":[[0,0,0,3],[2,1,5,1],[6,1,11,1],[12,1,15,1],[2,2,5,2],[6,2,11,2],[12,2,15,2],[2,0,15,0],[16,1,18,1],[16,2,18,2],[19,1,23,1],[19,2,23,2],[16,0,23,0],[24,1,26,1],[24,2,26,2],[27,1,29,1],[27,2,29,2],[24,0,29,0],[30,0,45,0],[46,1,48,1],[46,2,48,2],[49,1,51,1],[49,2,51,2],[30,1,34,1],[30,2,34,2],[35,1,38,1],[35,2,38,2],[39,1,45,1],[39,2,45,2],[52,1,57,1],[52,2,57,2],[58,1,60,1],[58,2,60,2],[46,0,60,0],[76,1,78,1],[76,2,78,2],[61,1,62,1],[61,2,62,2],[63,1,64,1],[63,2,64,2],[65,1,66,1],[65,2,66,2],[90,1,92,1],[90,2,92,2],[61,0,78,0],[79,0,92,0],[93,1,95,1],[93,2,95,2],[79,1,83,1],[79,2,83,2],[84,1,87,1],[84,2,87,2],[88,1,89,1],[88,2,89,2],[67,1,68,1],[67,2,68,2],[69,1,75,1],[69,2,75,2],[103,1,105,1],[103,2,105,2],[93,0,105,0],[106,1,110,1],[106,2,110,2],[96,1,97,1],[96,2,97,2],[98,1,100,1],[98,2,100,2],[101,1,102,1],[101,2,102,2],[125,1,130,1],[125,2,130,2],[125,0,130,0],[121,1,122,1],[121,2,122,2],[123,1,124,1],[123,2,124,2],[106,0,124,0],[111,1,113,1],[111,2,113,2],[114,1,117,1],[114,2,117,2],[118,1,120,1],[118,2,120,2]]}
["RECORDS MANAGEMENT\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)",{"$f":"IF(ISBLANK('1. Records management framework'!K1),\"\",'1. Records management framework'!K1)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!L1),\"\",'1. Records management framework'!L1)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!M1),\"\",'1. Records management framework'!M1)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!N1),\"\",'1. Records management framework'!N1)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!O1),\"\",'1. Records management framework'!O1)","v":""}]
["Records management framework",1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.1"," Assign strategic responsibility and oversight of records management to an appropriate executive board member (eg Senior Information Risk Owner (SIRO) or equivalent).",{"$f":"IF(ISBLANK('1. Records management framework'!E2),\"\",'1. Records management framework'!E2)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F2),\"\",'1. Records management framework'!F2)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G2),\"\",'1. Records management framework'!G2)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H2),\"\",'1. Records management framework'!H2)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I2),\"\",'1. Records management framework'!I2)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J2),\"\",'1. Records management framework'!J2)","v":""}]
[{"$f":"A3","v":"Records management framework"},{"$f":"B3","v":1.1000000000000001},"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.2","\tAssign operational responsibility and development of records management to an appropriate manager.",{"$f":"IF(ISBLANK('1. Records management framework'!E3),\"\",'1. Records management framework'!E3)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F3),\"\",'1. Records management framework'!F3)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G3),\"\",'1. Records management framework'!G3)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H3),\"\",'1. Records management framework'!H3)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I3),\"\",'1. Records management framework'!I3)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J3),\"\",'1. Records management framework'!J3)","v":""}]
["Records management framework",1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.3","\tAssign responsibility for implementing records management processes to local business areas (eg Information Asset Owners (IAOs), Information Asset Administrators (IAAs) and department managers).",{"$f":"IF(ISBLANK('1. Records management framework'!E4),\"\",'1. Records management framework'!E4)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F4),\"\",'1. Records management framework'!F4)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G4),\"\",'1. Records management framework'!G4)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H4),\"\",'1. Records management framework'!H4)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I4),\"\",'1. Records management framework'!I4)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J4),\"\",'1. Records management framework'!J4)","v":""}]
["Records management framework",1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.4","\tHave a regular steering group or meeting that monitors records management processes and functions and includes or reports to senior management.",{"$f":"IF(ISBLANK('1. Records management framework'!E5),\"\",'1. Records management framework'!E5)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F5),\"\",'1. Records management framework'!F5)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G5),\"\",'1. Records management framework'!G5)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H5),\"\",'1. Records management framework'!H5)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I5),\"\",'1. Records management framework'!I5)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J5),\"\",'1. Records management framework'!J5)","v":""}]
["Records management framework",1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.1","\tDocument each records management process in sufficient detail in policies, including who oversees processes and how.",{"$f":"IF(ISBLANK('1. Records management framework'!E6),\"\",'1. Records management framework'!E6)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F6),\"\",'1. Records management framework'!F6)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G6),\"\",'1. Records management framework'!G6)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H6),\"\",'1. Records management framework'!H6)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I6),\"\",'1. Records management framework'!I6)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J6),\"\",'1. Records management framework'!J6)","v":""}]
["Records management framework",{"$f":"B7","v":1.2000000000000002},"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.2","\tEnsure policies have appropriate document and version control.",{"$f":"IF(ISBLANK('1. Records management framework'!E7),\"\",'1. Records management framework'!E7)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F7),\"\",'1. Records management framework'!F7)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G7),\"\",'1. Records management framework'!G7)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H7),\"\",'1. Records management framework'!H7)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I7),\"\",'1. Records management framework'!I7)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J7),\"\",'1. Records management framework'!J7)","v":""}]
["Records management framework",1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.3","\tEnsure policies follow a standard format.",{"$f":"IF(ISBLANK('1. Records management framework'!E8),\"\",'1. Records management framework'!E8)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F8),\"\",'1. Records management framework'!F8)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G8),\"\",'1. Records management framework'!G8)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H8),\"\",'1. Records management framework'!H8)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I8),\"\",'1. Records management framework'!I8)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J8),\"\",'1. Records management framework'!J8)","v":""}]
["Records management framework",1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.4","\tEnsure policies are approved by senior management.",{"$f":"IF(ISBLANK('1. Records management framework'!E9),\"\",'1. Records management framework'!E9)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F9),\"\",'1. Records management framework'!F9)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G9),\"\",'1. Records management framework'!G9)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H9),\"\",'1. Records management framework'!H9)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I9),\"\",'1. Records management framework'!I9)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J9),\"\",'1. Records management framework'!J9)","v":""}]
["Records management framework",1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.5","\tCommunicate these policies to staff who create or manage records, and make policies readily available for them to refer to.",{"$f":"IF(ISBLANK('1. Records management framework'!E10),\"\",'1. Records management framework'!E10)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F10),\"\",'1. Records management framework'!F10)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G10),\"\",'1. Records management framework'!G10)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H10),\"\",'1. Records management framework'!H10)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I10),\"\",'1. Records management framework'!I10)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J10),\"\",'1. Records management framework'!J10)","v":""}]
["Records management framework",1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.6","\tKeep policies up-to-date, particularly with any changes to data protection law.",{"$f":"IF(ISBLANK('1. Records management framework'!E11),\"\",'1. Records management framework'!E11)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F11),\"\",'1. Records management framework'!F11)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G11),\"\",'1. Records management framework'!G11)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H11),\"\",'1. Records management framework'!H11)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I11),\"\",'1. Records management framework'!I11)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J11),\"\",'1. Records management framework'!J11)","v":""}]
["Records management framework",1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.1","\tTrain new staff on records management at induction.",{"$f":"IF(ISBLANK('1. Records management framework'!E12),\"\",'1. Records management framework'!E12)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F12),\"\",'1. Records management framework'!F12)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G12),\"\",'1. Records management framework'!G12)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H12),\"\",'1. Records management framework'!H12)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I12),\"\",'1. Records management framework'!I12)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J12),\"\",'1. Records management framework'!J12)","v":""}]
[{"$f":"A13","v":"Records management framework"},1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.2","\tProvide refresher training on records management processes to all staff periodically.",{"$f":"IF(ISBLANK('1. Records management framework'!E13),\"\",'1. Records management framework'!E13)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F13),\"\",'1. Records management framework'!F13)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G13),\"\",'1. Records management framework'!G13)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H13),\"\",'1. Records management framework'!H13)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I13),\"\",'1. Records management framework'!I13)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J13),\"\",'1. Records management framework'!J13)","v":""}]
["Records management framework",1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.3","\tTrack training completion and report it to senior management.",{"$f":"IF(ISBLANK('1. Records management framework'!E14),\"\",'1. Records management framework'!E14)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F14),\"\",'1. Records management framework'!F14)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G14),\"\",'1. Records management framework'!G14)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H14),\"\",'1. Records management framework'!H14)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I14),\"\",'1. Records management framework'!I14)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J14),\"\",'1. Records management framework'!J14)","v":""}]
["Records management framework",1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.4","\tGet input into training content from records management managers and subject matter experts.",{"$f":"IF(ISBLANK('1. Records management framework'!E15),\"\",'1. Records management framework'!E15)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!F15),\"\",'1. Records management framework'!F15)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!G15),\"\",'1. Records management framework'!G15)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!H15),\"\",'1. Records management framework'!H15)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!I15),\"\",'1. Records management framework'!I15)","v":""},{"$f":"IF(ISBLANK('1. Records management framework'!J15),\"\",'1. Records management framework'!J15)","v":""}]
["Data collection",2.1,"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.1","\tPublish privacy information that includes all the information required by data protection law.",{"$f":"IF(ISBLANK('2. Data collection'!E2),\"\",'2. Data collection'!E2)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F2),\"\",'2. Data collection'!F2)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G2),\"\",'2. Data collection'!G2)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H2),\"\",'2. Data collection'!H2)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I2),\"\",'2. Data collection'!I2)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J2),\"\",'2. Data collection'!J2)","v":""}]
[{"$f":"A17","v":"Data collection"},{"$f":"B17","v":2.1},"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.2","\tProvide privacy information at the point that you collect personal information.",{"$f":"IF(ISBLANK('2. Data collection'!E3),\"\",'2. Data collection'!E3)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F3),\"\",'2. Data collection'!F3)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G3),\"\",'2. Data collection'!G3)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H3),\"\",'2. Data collection'!H3)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I3),\"\",'2. Data collection'!I3)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J3),\"\",'2. Data collection'!J3)","v":""}]
["Data collection",2.1,"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.3","\tProduce privacy information in a variety of formats (eg posters and leaflets), in addition to online privacy notices.",{"$f":"IF(ISBLANK('2. Data collection'!E4),\"\",'2. Data collection'!E4)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F4),\"\",'2. Data collection'!F4)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G4),\"\",'2. Data collection'!G4)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H4),\"\",'2. Data collection'!H4)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I4),\"\",'2. Data collection'!I4)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J4),\"\",'2. Data collection'!J4)","v":""}]
["Data collection",2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.1","\tPresent privacy information clearly and prominently on your website or in another appropriate format at the point that you collect it.",{"$f":"IF(ISBLANK('2. Data collection'!E5),\"\",'2. Data collection'!E5)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F5),\"\",'2. Data collection'!F5)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G5),\"\",'2. Data collection'!G5)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H5),\"\",'2. Data collection'!H5)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I5),\"\",'2. Data collection'!I5)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J5),\"\",'2. Data collection'!J5)","v":""}]
[{"$f":"A20","v":"Data collection"},2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.2","\tProvide privacy information in a layered format (eg summaries at the top with further detailed information below).",{"$f":"IF(ISBLANK('2. Data collection'!E6),\"\",'2. Data collection'!E6)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F6),\"\",'2. Data collection'!F6)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G6),\"\",'2. Data collection'!G6)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H6),\"\",'2. Data collection'!H6)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I6),\"\",'2. Data collection'!I6)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J6),\"\",'2. Data collection'!J6)","v":""}]
["Data collection",2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.3","\tProvide privacy information in different languages or styles to ensure people can understand it, including separate age-appropriate notices, where relevant.",{"$f":"IF(ISBLANK('2. Data collection'!E7),\"\",'2. Data collection'!E7)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F7),\"\",'2. Data collection'!F7)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G7),\"\",'2. Data collection'!G7)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H7),\"\",'2. Data collection'!H7)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I7),\"\",'2. Data collection'!I7)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J7),\"\",'2. Data collection'!J7)","v":""}]
["Data collection",2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.4","\tHave the ability to provide privacy information in more accessible formats (eg in braille or large font).",{"$f":"IF(ISBLANK('2. Data collection'!E8),\"\",'2. Data collection'!E8)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F8),\"\",'2. Data collection'!F8)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G8),\"\",'2. Data collection'!G8)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H8),\"\",'2. Data collection'!H8)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I8),\"\",'2. Data collection'!I8)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J8),\"\",'2. Data collection'!J8)","v":""}]
["Data collection",2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.5","\tUse clear, plain, non-technical language when explaining processing.",{"$f":"IF(ISBLANK('2. Data collection'!E9),\"\",'2. Data collection'!E9)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!F9),\"\",'2. Data collection'!F9)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!G9),\"\",'2. Data collection'!G9)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!H9),\"\",'2. Data collection'!H9)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!I9),\"\",'2. Data collection'!I9)","v":""},{"$f":"IF(ISBLANK('2. Data collection'!J9),\"\",'2. Data collection'!J9)","v":""}]
["Record creation",3.1,"Processes for creating records or documented information are in place and outlined in policies.","3.1.1","\tDocument record creation processes in sufficient detail in policies, including document management protocols, metadata use, and record formatting and classification.",{"$f":"IF(ISBLANK('3. Record creation '!E2),\"\",'3. Record creation '!E2)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F2),\"\",'3. Record creation '!F2)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G2),\"\",'3. Record creation '!G2)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H2),\"\",'3. Record creation '!H2)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I2),\"\",'3. Record creation '!I2)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J2),\"\",'3. Record creation '!J2)","v":""}]
[{"$f":"A25","v":"Record creation"},{"$f":"B25","v":3.1},"Processes for creating records or documented information are in place and outlined in policies.","3.1.2","\tHighlight changes to processes clearly in policies (eg in a change history). ",{"$f":"IF(ISBLANK('3. Record creation '!E3),\"\",'3. Record creation '!E3)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F3),\"\",'3. Record creation '!F3)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G3),\"\",'3. Record creation '!G3)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H3),\"\",'3. Record creation '!H3)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I3),\"\",'3. Record creation '!I3)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J3),\"\",'3. Record creation '!J3)","v":""}]
["Record creation",3.1,"Processes for creating records or documented information are in place and outlined in policies.","3.1.3","\tCommunicate processes to staff who create records and make policies readily available for them to refer to.",{"$f":"IF(ISBLANK('3. Record creation '!E4),\"\",'3. Record creation '!E4)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F4),\"\",'3. Record creation '!F4)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G4),\"\",'3. Record creation '!G4)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H4),\"\",'3. Record creation '!H4)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I4),\"\",'3. Record creation '!I4)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J4),\"\",'3. Record creation '!J4)","v":""}]
["Record creation",3.2,"Records are appropriately identified and classified.","3.2.1","\tAssign appropriate security classification to records and personal information.",{"$f":"IF(ISBLANK('3. Record creation '!E5),\"\",'3. Record creation '!E5)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F5),\"\",'3. Record creation '!F5)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G5),\"\",'3. Record creation '!G5)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H5),\"\",'3. Record creation '!H5)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I5),\"\",'3. Record creation '!I5)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J5),\"\",'3. Record creation '!J5)","v":""}]
[{"$f":"A28","v":"Record creation"},3.2,"Records are appropriately identified and classified.","3.2.2","\tClearly identify and describe records and personal information (eg in file names and metadata).",{"$f":"IF(ISBLANK('3. Record creation '!E6),\"\",'3. Record creation '!E6)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F6),\"\",'3. Record creation '!F6)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G6),\"\",'3. Record creation '!G6)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H6),\"\",'3. Record creation '!H6)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I6),\"\",'3. Record creation '!I6)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J6),\"\",'3. Record creation '!J6)","v":""}]
["Record creation",3.2,"Records are appropriately identified and classified.","3.2.3","\tDocument classification and identification processes in sufficient detail in policies, including document management protocols, metadata use, and record formatting.",{"$f":"IF(ISBLANK('3. Record creation '!E7),\"\",'3. Record creation '!E7)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!F7),\"\",'3. Record creation '!F7)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!G7),\"\",'3. Record creation '!G7)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!H7),\"\",'3. Record creation '!H7)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!I7),\"\",'3. Record creation '!I7)","v":""},{"$f":"IF(ISBLANK('3. Record creation '!J7),\"\",'3. Record creation '!J7)","v":""}]
["Data mapping and recording",4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.1","\tComplete a comprehensive information audit across all areas or departments.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E2),\"\",'4. Data mapping and recording'!E2)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F2),\"\",'4. Data mapping and recording'!F2)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G2),\"\",'4. Data mapping and recording'!G2)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H2),\"\",'4. Data mapping and recording'!H2)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I2),\"\",'4. Data mapping and recording'!I2)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J2),\"\",'4. Data mapping and recording'!J2)","v":""}]
[{"$f":"A31","v":"Data mapping and recording"},{"$f":"B31","v":4.0999999999999996},"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.2","Produce an information flow map based on the information audit.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E3),\"\",'4. Data mapping and recording'!E3)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F3),\"\",'4. Data mapping and recording'!F3)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G3),\"\",'4. Data mapping and recording'!G3)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H3),\"\",'4. Data mapping and recording'!H3)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I3),\"\",'4. Data mapping and recording'!I3)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J3),\"\",'4. Data mapping and recording'!J3)","v":""}]
["Data mapping and recording",4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.3","\tRepeat the information audit and review the information flow map regularly to capture changes.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E4),\"\",'4. Data mapping and recording'!E4)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F4),\"\",'4. Data mapping and recording'!F4)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G4),\"\",'4. Data mapping and recording'!G4)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H4),\"\",'4. Data mapping and recording'!H4)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I4),\"\",'4. Data mapping and recording'!I4)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J4),\"\",'4. Data mapping and recording'!J4)","v":""}]
["Data mapping and recording",4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.4","\tLog details about information assets in an information asset register.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E5),\"\",'4. Data mapping and recording'!E5)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F5),\"\",'4. Data mapping and recording'!F5)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G5),\"\",'4. Data mapping and recording'!G5)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H5),\"\",'4. Data mapping and recording'!H5)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I5),\"\",'4. Data mapping and recording'!I5)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J5),\"\",'4. Data mapping and recording'!J5)","v":""}]
["Data mapping and recording",4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.5","\tAssign responsibilities for maintaining and amending the information asset register.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E6),\"\",'4. Data mapping and recording'!E6)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F6),\"\",'4. Data mapping and recording'!F6)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G6),\"\",'4. Data mapping and recording'!G6)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H6),\"\",'4. Data mapping and recording'!H6)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I6),\"\",'4. Data mapping and recording'!I6)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J6),\"\",'4. Data mapping and recording'!J6)","v":""}]
["Data mapping and recording",4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.1","\tHave a controlled inventory or register of all records.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E7),\"\",'4. Data mapping and recording'!E7)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F7),\"\",'4. Data mapping and recording'!F7)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G7),\"\",'4. Data mapping and recording'!G7)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H7),\"\",'4. Data mapping and recording'!H7)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I7),\"\",'4. Data mapping and recording'!I7)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J7),\"\",'4. Data mapping and recording'!J7)","v":""}]
["Data mapping and recording",{"$f":"B36","v":4.2},"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.2","\tKeep the inventory or register updated.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E8),\"\",'4. Data mapping and recording'!E8)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F8),\"\",'4. Data mapping and recording'!F8)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G8),\"\",'4. Data mapping and recording'!G8)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H8),\"\",'4. Data mapping and recording'!H8)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I8),\"\",'4. Data mapping and recording'!I8)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J8),\"\",'4. Data mapping and recording'!J8)","v":""}]
["Data mapping and recording",4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.3","\tAudit the inventory or register regularly to ensure it is accurate.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E9),\"\",'4. Data mapping and recording'!E9)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F9),\"\",'4. Data mapping and recording'!F9)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G9),\"\",'4. Data mapping and recording'!G9)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H9),\"\",'4. Data mapping and recording'!H9)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I9),\"\",'4. Data mapping and recording'!I9)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J9),\"\",'4. Data mapping and recording'!J9)","v":""}]
["Data mapping and recording",4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.4","\tUse the inventory or register to inform records management practices.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E10),\"\",'4. Data mapping and recording'!E10)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F10),\"\",'4. Data mapping and recording'!F10)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G10),\"\",'4. Data mapping and recording'!G10)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H10),\"\",'4. Data mapping and recording'!H10)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I10),\"\",'4. Data mapping and recording'!I10)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J10),\"\",'4. Data mapping and recording'!J10)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.1","\tUpdate the ROPA if there are any changes to the inventory or register of information flows to ensure details match.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E11),\"\",'4. Data mapping and recording'!E11)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F11),\"\",'4. Data mapping and recording'!F11)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G11),\"\",'4. Data mapping and recording'!G11)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H11),\"\",'4. Data mapping and recording'!H11)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I11),\"\",'4. Data mapping and recording'!I11)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J11),\"\",'4. Data mapping and recording'!J11)","v":""}]
[{"$f":"A40","v":"Data mapping and recording"},4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.2","\tDocument the purpose, categories of people, and categories of personal information, for each processing activity in your ROPA and whether you are a controller, joint controller or processor.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E12),\"\",'4. Data mapping and recording'!E12)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F12),\"\",'4. Data mapping and recording'!F12)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G12),\"\",'4. Data mapping and recording'!G12)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H12),\"\",'4. Data mapping and recording'!H12)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I12),\"\",'4. Data mapping and recording'!I12)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J12),\"\",'4. Data mapping and recording'!J12)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.3","\tDocument the lawful basis, and additional conditions, if required, for each processing activity in your ROPA.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E13),\"\",'4. Data mapping and recording'!E13)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F13),\"\",'4. Data mapping and recording'!F13)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G13),\"\",'4. Data mapping and recording'!G13)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H13),\"\",'4. Data mapping and recording'!H13)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I13),\"\",'4. Data mapping and recording'!I13)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J13),\"\",'4. Data mapping and recording'!J13)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.4","\tDocument the source of personal information you process, where and how you store it, and the retention period, for each processing activity in your ROPA.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E14),\"\",'4. Data mapping and recording'!E14)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F14),\"\",'4. Data mapping and recording'!F14)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G14),\"\",'4. Data mapping and recording'!G14)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H14),\"\",'4. Data mapping and recording'!H14)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I14),\"\",'4. Data mapping and recording'!I14)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J14),\"\",'4. Data mapping and recording'!J14)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.5","\tDocument the technical and organisational security measures for each processing activity in your ROPA.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E15),\"\",'4. Data mapping and recording'!E15)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F15),\"\",'4. Data mapping and recording'!F15)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G15),\"\",'4. Data mapping and recording'!G15)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H15),\"\",'4. Data mapping and recording'!H15)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I15),\"\",'4. Data mapping and recording'!I15)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J15),\"\",'4. Data mapping and recording'!J15)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.6","\tDocument the recipients of shared information, and safeguards and adequacy decisions if information is transferred internationally, for each processing activity in your ROPA.",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E16),\"\",'4. Data mapping and recording'!E16)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F16),\"\",'4. Data mapping and recording'!F16)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G16),\"\",'4. Data mapping and recording'!G16)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H16),\"\",'4. Data mapping and recording'!H16)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I16),\"\",'4. Data mapping and recording'!I16)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J16),\"\",'4. Data mapping and recording'!J16)","v":""}]
["Data mapping and recording",4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.7","\tInclude links to other relevant information (eg consent logs, third-party contracts, data protection impact assessments (DPIA), and personal data breach reports).",{"$f":"IF(ISBLANK('4. Data mapping and recording'!E17),\"\",'4. Data mapping and recording'!E17)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!F17),\"\",'4. Data mapping and recording'!F17)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!G17),\"\",'4. Data mapping and recording'!G17)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!H17),\"\",'4. Data mapping and recording'!H17)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!I17),\"\",'4. Data mapping and recording'!I17)","v":""},{"$f":"IF(ISBLANK('4. Data mapping and recording'!J17),\"\",'4. Data mapping and recording'!J17)","v":""}]
["Access",5.0999999999999996,"Access controls are in place to prevent unauthorised access to physical records.","5.1.1","\tKeep physical records in locked rooms, cabinets, cupboards, or drawers.",{"$f":"IF(ISBLANK('5. Access'!E2),\"\",'5. Access'!E2)","v":""},{"$f":"IF(ISBLANK('5. Access'!F2),\"\",'5. Access'!F2)","v":""},{"$f":"IF(ISBLANK('5. Access'!G2),\"\",'5. Access'!G2)","v":""},{"$f":"IF(ISBLANK('5. Access'!H2),\"\",'5. Access'!H2)","v":""},{"$f":"IF(ISBLANK('5. Access'!I2),\"\",'5. Access'!I2)","v":""},{"$f":"IF(ISBLANK('5. Access'!J2),\"\",'5. Access'!J2)","v":""}]
[{"$f":"A47","v":"Access"},{"$f":"B47","v":5.0999999999999996},"Access controls are in place to prevent unauthorised access to physical records.","5.1.2","\tHave an access log to show who has accessed physical records.",{"$f":"IF(ISBLANK('5. Access'!E3),\"\",'5. Access'!E3)","v":""},{"$f":"IF(ISBLANK('5. Access'!F3),\"\",'5. Access'!F3)","v":""},{"$f":"IF(ISBLANK('5. Access'!G3),\"\",'5. Access'!G3)","v":""},{"$f":"IF(ISBLANK('5. Access'!H3),\"\",'5. Access'!H3)","v":""},{"$f":"IF(ISBLANK('5. Access'!I3),\"\",'5. Access'!I3)","v":""},{"$f":"IF(ISBLANK('5. Access'!J3),\"\",'5. Access'!J3)","v":""}]
["Access",5.0999999999999996,"Access controls are in place to prevent unauthorised access to physical records.","5.1.3","\tEnsure staff are aware that they should not leave records unattended without locking them away.",{"$f":"IF(ISBLANK('5. Access'!E4),\"\",'5. Access'!E4)","v":""},{"$f":"IF(ISBLANK('5. Access'!F4),\"\",'5. Access'!F4)","v":""},{"$f":"IF(ISBLANK('5. Access'!G4),\"\",'5. Access'!G4)","v":""},{"$f":"IF(ISBLANK('5. Access'!H4),\"\",'5. Access'!H4)","v":""},{"$f":"IF(ISBLANK('5. Access'!I4),\"\",'5. Access'!I4)","v":""},{"$f":"IF(ISBLANK('5. Access'!J4),\"\",'5. Access'!J4)","v":""}]
["Access",5.2,"The security of physical records storage areas and buildings is periodically audited.","5.2.1","\tReview the security and integrity of buildings and records storage areas regularly as part of internal and external audit programmes.",{"$f":"IF(ISBLANK('5. Access'!E5),\"\",'5. Access'!E5)","v":""},{"$f":"IF(ISBLANK('5. Access'!F5),\"\",'5. Access'!F5)","v":""},{"$f":"IF(ISBLANK('5. Access'!G5),\"\",'5. Access'!G5)","v":""},{"$f":"IF(ISBLANK('5. Access'!H5),\"\",'5. Access'!H5)","v":""},{"$f":"IF(ISBLANK('5. Access'!I5),\"\",'5. Access'!I5)","v":""},{"$f":"IF(ISBLANK('5. Access'!J5),\"\",'5. Access'!J5)","v":""}]
["Access",{"$f":"B50","v":5.2},"The security of physical records storage areas and buildings is periodically audited.","5.2.2","\tReview the security and integrity of third-party records storage areas and premises periodically.",{"$f":"IF(ISBLANK('5. Access'!E6),\"\",'5. Access'!E6)","v":""},{"$f":"IF(ISBLANK('5. Access'!F6),\"\",'5. Access'!F6)","v":""},{"$f":"IF(ISBLANK('5. Access'!G6),\"\",'5. Access'!G6)","v":""},{"$f":"IF(ISBLANK('5. Access'!H6),\"\",'5. Access'!H6)","v":""},{"$f":"IF(ISBLANK('5. Access'!I6),\"\",'5. Access'!I6)","v":""},{"$f":"IF(ISBLANK('5. Access'!J6),\"\",'5. Access'!J6)","v":""}]
["Access",5.2,"The security of physical records storage areas and buildings is periodically audited.","5.2.3","\tDocument in contracts the right to audit third-party records storage providers.",{"$f":"IF(ISBLANK('5. Access'!E7),\"\",'5. Access'!E7)","v":""},{"$f":"IF(ISBLANK('5. Access'!F7),\"\",'5. Access'!F7)","v":""},{"$f":"IF(ISBLANK('5. Access'!G7),\"\",'5. Access'!G7)","v":""},{"$f":"IF(ISBLANK('5. Access'!H7),\"\",'5. Access'!H7)","v":""},{"$f":"IF(ISBLANK('5. Access'!I7),\"\",'5. Access'!I7)","v":""},{"$f":"IF(ISBLANK('5. Access'!J7),\"\",'5. Access'!J7)","v":""}]
["Access",5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.1","\tDocument access control processes in a policy.",{"$f":"IF(ISBLANK('5. Access'!E8),\"\",'5. Access'!E8)","v":""},{"$f":"IF(ISBLANK('5. Access'!F8),\"\",'5. Access'!F8)","v":""},{"$f":"IF(ISBLANK('5. Access'!G8),\"\",'5. Access'!G8)","v":""},{"$f":"IF(ISBLANK('5. Access'!H8),\"\",'5. Access'!H8)","v":""},{"$f":"IF(ISBLANK('5. Access'!I8),\"\",'5. Access'!I8)","v":""},{"$f":"IF(ISBLANK('5. Access'!J8),\"\",'5. Access'!J8)","v":""}]
["Access",{"$f":"B53","v":5.3},"Access controls are in place to prevent unauthorised access to electronic records.","5.3.2","\tGet input from the Records Manager into access control processes.",{"$f":"IF(ISBLANK('5. Access'!E9),\"\",'5. Access'!E9)","v":""},{"$f":"IF(ISBLANK('5. Access'!F9),\"\",'5. Access'!F9)","v":""},{"$f":"IF(ISBLANK('5. Access'!G9),\"\",'5. Access'!G9)","v":""},{"$f":"IF(ISBLANK('5. Access'!H9),\"\",'5. Access'!H9)","v":""},{"$f":"IF(ISBLANK('5. Access'!I9),\"\",'5. Access'!I9)","v":""},{"$f":"IF(ISBLANK('5. Access'!J9),\"\",'5. Access'!J9)","v":""}]
["Access",5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.3","\tAssign access rights based on documented job role profiles.",{"$f":"IF(ISBLANK('5. Access'!E10),\"\",'5. Access'!E10)","v":""},{"$f":"IF(ISBLANK('5. Access'!F10),\"\",'5. Access'!F10)","v":""},{"$f":"IF(ISBLANK('5. Access'!G10),\"\",'5. Access'!G10)","v":""},{"$f":"IF(ISBLANK('5. Access'!H10),\"\",'5. Access'!H10)","v":""},{"$f":"IF(ISBLANK('5. Access'!I10),\"\",'5. Access'!I10)","v":""},{"$f":"IF(ISBLANK('5. Access'!J10),\"\",'5. Access'!J10)","v":""}]
["Access",5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.4","\tHave a process to quickly grant, amend, and remove access rights to new starters, movers, and leavers.",{"$f":"IF(ISBLANK('5. Access'!E11),\"\",'5. Access'!E11)","v":""},{"$f":"IF(ISBLANK('5. Access'!F11),\"\",'5. Access'!F11)","v":""},{"$f":"IF(ISBLANK('5. Access'!G11),\"\",'5. Access'!G11)","v":""},{"$f":"IF(ISBLANK('5. Access'!H11),\"\",'5. Access'!H11)","v":""},{"$f":"IF(ISBLANK('5. Access'!I11),\"\",'5. Access'!I11)","v":""},{"$f":"IF(ISBLANK('5. Access'!J11),\"\",'5. Access'!J11)","v":""}]
["Access",5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.5","\tEnsure access control measures that are detailed in policies include appropriate technical solutions (eg password rules, anti-malware and virus protection, firewall controls and vulnerability testing).",{"$f":"IF(ISBLANK('5. Access'!E12),\"\",'5. Access'!E12)","v":""},{"$f":"IF(ISBLANK('5. Access'!F12),\"\",'5. Access'!F12)","v":""},{"$f":"IF(ISBLANK('5. Access'!G12),\"\",'5. Access'!G12)","v":""},{"$f":"IF(ISBLANK('5. Access'!H12),\"\",'5. Access'!H12)","v":""},{"$f":"IF(ISBLANK('5. Access'!I12),\"\",'5. Access'!I12)","v":""},{"$f":"IF(ISBLANK('5. Access'!J12),\"\",'5. Access'!J12)","v":""}]
["Access",5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.6","\tMonitor systems and records access regularly to identify inappropriate or unauthorised access.",{"$f":"IF(ISBLANK('5. Access'!E13),\"\",'5. Access'!E13)","v":""},{"$f":"IF(ISBLANK('5. Access'!F13),\"\",'5. Access'!F13)","v":""},{"$f":"IF(ISBLANK('5. Access'!G13),\"\",'5. Access'!G13)","v":""},{"$f":"IF(ISBLANK('5. Access'!H13),\"\",'5. Access'!H13)","v":""},{"$f":"IF(ISBLANK('5. Access'!I13),\"\",'5. Access'!I13)","v":""},{"$f":"IF(ISBLANK('5. Access'!J13),\"\",'5. Access'!J13)","v":""}]
["Access",5.4,"User access permissions for electronic records is logged and periodically reviewed.","5.4.1","\tLog all access rights granted.",{"$f":"IF(ISBLANK('5. Access'!E14),\"\",'5. Access'!E14)","v":""},{"$f":"IF(ISBLANK('5. Access'!F14),\"\",'5. Access'!F14)","v":""},{"$f":"IF(ISBLANK('5. Access'!G14),\"\",'5. Access'!G14)","v":""},{"$f":"IF(ISBLANK('5. Access'!H14),\"\",'5. Access'!H14)","v":""},{"$f":"IF(ISBLANK('5. Access'!I14),\"\",'5. Access'!I14)","v":""},{"$f":"IF(ISBLANK('5. Access'!J14),\"\",'5. Access'!J14)","v":""}]
[{"$f":"A59","v":"Access"},5.4,"User access permissions for electronic records is logged and periodically reviewed.","5.4.2","\tReview all access rights periodically.",{"$f":"IF(ISBLANK('5. Access'!E15),\"\",'5. Access'!E15)","v":""},{"$f":"IF(ISBLANK('5. Access'!F15),\"\",'5. Access'!F15)","v":""},{"$f":"IF(ISBLANK('5. Access'!G15),\"\",'5. Access'!G15)","v":""},{"$f":"IF(ISBLANK('5. Access'!H15),\"\",'5. Access'!H15)","v":""},{"$f":"IF(ISBLANK('5. Access'!I15),\"\",'5. Access'!I15)","v":""},{"$f":"IF(ISBLANK('5. Access'!J15),\"\",'5. Access'!J15)","v":""}]
["Access",5.4,"User access permissions for electronic records is logged and periodically reviewed.","5.4.3","\tHave a process to remove access or deactivate user accounts after a period of inactivity.",{"$f":"IF(ISBLANK('5. Access'!E16),\"\",'5. Access'!E16)","v":""},{"$f":"IF(ISBLANK('5. Access'!F16),\"\",'5. Access'!F16)","v":""},{"$f":"IF(ISBLANK('5. Access'!G16),\"\",'5. Access'!G16)","v":""},{"$f":"IF(ISBLANK('5. Access'!H16),\"\",'5. Access'!H16)","v":""},{"$f":"IF(ISBLANK('5. Access'!I16),\"\",'5. Access'!I16)","v":""},{"$f":"IF(ISBLANK('5. Access'!J16),\"\",'5. Access'!J16)","v":""}]
["Movement and retrieval",6.1,"The whereabouts of physical records are known at all times and the movement of records between storage and office areas is logged and tracked to help control and provide an audit trail of all record transactions.","6.1.1","\tHave a process or system to log the current locations of all physical records.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E2),\"\",'6. Movement and retrieval'!E2)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F2),\"\",'6. Movement and retrieval'!F2)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G2),\"\",'6. Movement and retrieval'!G2)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H2),\"\",'6. Movement and retrieval'!H2)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I2),\"\",'6. Movement and retrieval'!I2)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J2),\"\",'6. Movement and retrieval'!J2)","v":""}]
[{"$f":"A62","v":"Movement and retrieval"},{"$f":"B62","v":6.1},"The whereabouts of physical records are known at all times and the movement of records between storage and office areas is logged and tracked to help control and provide an audit trail of all record transactions.","6.1.2","\tTrack the movement, transfer, and access to any physical records.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E3),\"\",'6. Movement and retrieval'!E3)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F3),\"\",'6. Movement and retrieval'!F3)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G3),\"\",'6. Movement and retrieval'!G3)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H3),\"\",'6. Movement and retrieval'!H3)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I3),\"\",'6. Movement and retrieval'!I3)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J3),\"\",'6. Movement and retrieval'!J3)","v":""}]
["Movement and retrieval",6.2,"Records stored off-site are indexed with unique references to enable accurate retrieval and subsequent tracking.","6.2.1","Document what referencing or indexing system is used.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E4),\"\",'6. Movement and retrieval'!E4)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F4),\"\",'6. Movement and retrieval'!F4)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G4),\"\",'6. Movement and retrieval'!G4)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H4),\"\",'6. Movement and retrieval'!H4)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I4),\"\",'6. Movement and retrieval'!I4)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J4),\"\",'6. Movement and retrieval'!J4)","v":""}]
["Movement and retrieval",{"$f":"B64","v":6.2},"Records stored off-site are indexed with unique references to enable accurate retrieval and subsequent tracking.","6.2.2","\tLog the location of records stored off-site using the index reference.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E5),\"\",'6. Movement and retrieval'!E5)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F5),\"\",'6. Movement and retrieval'!F5)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G5),\"\",'6. Movement and retrieval'!G5)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H5),\"\",'6. Movement and retrieval'!H5)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I5),\"\",'6. Movement and retrieval'!I5)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J5),\"\",'6. Movement and retrieval'!J5)","v":""}]
["Movement and retrieval",6.3,"Retrieval and tracking mechanisms are checked to ensure they remain effective.","6.3.1","\tMeasure performance metrics or key performance indicators for record retrieval and tracking mechanisms (eg the time taken to retrieve records or the number of records away from their assigned location for an extended time).",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E6),\"\",'6. Movement and retrieval'!E6)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F6),\"\",'6. Movement and retrieval'!F6)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G6),\"\",'6. Movement and retrieval'!G6)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H6),\"\",'6. Movement and retrieval'!H6)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I6),\"\",'6. Movement and retrieval'!I6)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J6),\"\",'6. Movement and retrieval'!J6)","v":""}]
["Movement and retrieval",{"$f":"B66","v":6.3},"Retrieval and tracking mechanisms are checked to ensure they remain effective.","6.3.2","\tCheck or periodically audit that record locations are accurate.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E7),\"\",'6. Movement and retrieval'!E7)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F7),\"\",'6. Movement and retrieval'!F7)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G7),\"\",'6. Movement and retrieval'!G7)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H7),\"\",'6. Movement and retrieval'!H7)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I7),\"\",'6. Movement and retrieval'!I7)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J7),\"\",'6. Movement and retrieval'!J7)","v":""}]
["Movement and retrieval",6.4,"Systems have the functionality to easily locate and retrieve electronic records.","6.4.1","\tEmbed search functionality into system design from the outset.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E8),\"\",'6. Movement and retrieval'!E8)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F8),\"\",'6. Movement and retrieval'!F8)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G8),\"\",'6. Movement and retrieval'!G8)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H8),\"\",'6. Movement and retrieval'!H8)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I8),\"\",'6. Movement and retrieval'!I8)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J8),\"\",'6. Movement and retrieval'!J8)","v":""}]
["Movement and retrieval",{"$f":"B68","v":6.4},"Systems have the functionality to easily locate and retrieve electronic records.","6.4.2","\tUse naming conventions, metadata, and data labels so staff can easily locate and retrieve electronic records.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E9),\"\",'6. Movement and retrieval'!E9)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F9),\"\",'6. Movement and retrieval'!F9)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G9),\"\",'6. Movement and retrieval'!G9)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H9),\"\",'6. Movement and retrieval'!H9)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I9),\"\",'6. Movement and retrieval'!I9)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J9),\"\",'6. Movement and retrieval'!J9)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.1","\tDocument security arrangements for physical records taken off-site in records management and remote working policies.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E10),\"\",'6. Movement and retrieval'!E10)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F10),\"\",'6. Movement and retrieval'!F10)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G10),\"\",'6. Movement and retrieval'!G10)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H10),\"\",'6. Movement and retrieval'!H10)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I10),\"\",'6. Movement and retrieval'!I10)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J10),\"\",'6. Movement and retrieval'!J10)","v":""}]
["Movement and retrieval",{"$f":"B70","v":6.5},"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.2","\tLog records that are taken off-site and who by.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E11),\"\",'6. Movement and retrieval'!E11)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F11),\"\",'6. Movement and retrieval'!F11)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G11),\"\",'6. Movement and retrieval'!G11)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H11),\"\",'6. Movement and retrieval'!H11)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I11),\"\",'6. Movement and retrieval'!I11)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J11),\"\",'6. Movement and retrieval'!J11)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.3","\tEnsure physical records are unmarked, transported securely in a locked case or bag, and not left unattended on public transport or in hotel rooms.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E12),\"\",'6. Movement and retrieval'!E12)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F12),\"\",'6. Movement and retrieval'!F12)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G12),\"\",'6. Movement and retrieval'!G12)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H12),\"\",'6. Movement and retrieval'!H12)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I12),\"\",'6. Movement and retrieval'!I12)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J12),\"\",'6. Movement and retrieval'!J12)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.4","\tAssess the risks of records being routinely taken off-site before they are removed.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E13),\"\",'6. Movement and retrieval'!E13)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F13),\"\",'6. Movement and retrieval'!F13)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G13),\"\",'6. Movement and retrieval'!G13)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H13),\"\",'6. Movement and retrieval'!H13)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I13),\"\",'6. Movement and retrieval'!I13)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J13),\"\",'6. Movement and retrieval'!J13)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.5","\tEnsure records created off-site or at home are kept secure, returned, or destroyed.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E14),\"\",'6. Movement and retrieval'!E14)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F14),\"\",'6. Movement and retrieval'!F14)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G14),\"\",'6. Movement and retrieval'!G14)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H14),\"\",'6. Movement and retrieval'!H14)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I14),\"\",'6. Movement and retrieval'!I14)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J14),\"\",'6. Movement and retrieval'!J14)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.6","\tDocument how staff should securely keep and destroy records when working from home.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E15),\"\",'6. Movement and retrieval'!E15)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F15),\"\",'6. Movement and retrieval'!F15)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G15),\"\",'6. Movement and retrieval'!G15)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H15),\"\",'6. Movement and retrieval'!H15)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I15),\"\",'6. Movement and retrieval'!I15)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J15),\"\",'6. Movement and retrieval'!J15)","v":""}]
["Movement and retrieval",6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.7","\tDocument how staff should securely keep and destroy records when working from home.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E16),\"\",'6. Movement and retrieval'!E16)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F16),\"\",'6. Movement and retrieval'!F16)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G16),\"\",'6. Movement and retrieval'!G16)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H16),\"\",'6. Movement and retrieval'!H16)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I16),\"\",'6. Movement and retrieval'!I16)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J16),\"\",'6. Movement and retrieval'!J16)","v":""}]
["Movement and retrieval",6.6,"Records are transferred securely internally or externally to third parties.","6.6.1","\tSecure physical records that are transferred externally by post or courier.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E17),\"\",'6. Movement and retrieval'!E17)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F17),\"\",'6. Movement and retrieval'!F17)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G17),\"\",'6. Movement and retrieval'!G17)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H17),\"\",'6. Movement and retrieval'!H17)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I17),\"\",'6. Movement and retrieval'!I17)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J17),\"\",'6. Movement and retrieval'!J17)","v":""}]
[{"$f":"A77","v":"Movement and retrieval"},6.6,"Records are transferred securely internally or externally to third parties.","6.6.2","\tSecure electronic records that are transferred internally or externally (eg by using encryption, secure file transfer protocol or online secure file sharing areas).",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E18),\"\",'6. Movement and retrieval'!E18)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F18),\"\",'6. Movement and retrieval'!F18)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G18),\"\",'6. Movement and retrieval'!G18)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H18),\"\",'6. Movement and retrieval'!H18)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I18),\"\",'6. Movement and retrieval'!I18)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J18),\"\",'6. Movement and retrieval'!J18)","v":""}]
["Movement and retrieval",6.6,"Records are transferred securely internally or externally to third parties.","6.6.3","\tDocument information transfer policies or rules in policies and communicate them clearly to all staff.",{"$f":"IF(ISBLANK('6. Movement and retrieval'!E19),\"\",'6. Movement and retrieval'!E19)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!F19),\"\",'6. Movement and retrieval'!F19)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!G19),\"\",'6. Movement and retrieval'!G19)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!H19),\"\",'6. Movement and retrieval'!H19)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!I19),\"\",'6. Movement and retrieval'!I19)","v":""},{"$f":"IF(ISBLANK('6. Movement and retrieval'!J19),\"\",'6. Movement and retrieval'!J19)","v":""}]
["Maintenance and accuracy",7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.1","\tDocument how to handle rectification requests in sufficient detail in policies, including who oversees the request process and how.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E2),\"\",'7. Maintenance and accuracy'!E2)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F2),\"\",'7. Maintenance and accuracy'!F2)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G2),\"\",'7. Maintenance and accuracy'!G2)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H2),\"\",'7. Maintenance and accuracy'!H2)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I2),\"\",'7. Maintenance and accuracy'!I2)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J2),\"\",'7. Maintenance and accuracy'!J2)","v":""}]
[{"$f":"A80","v":"Maintenance and accuracy"},{"$f":"B80","v":7.1},"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.2","\tHave a process to determine whether information is inaccurate, and how to correct it quickly or document the inaccuracy, if you can't rectify it.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E3),\"\",'7. Maintenance and accuracy'!E3)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F3),\"\",'7. Maintenance and accuracy'!F3)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G3),\"\",'7. Maintenance and accuracy'!G3)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H3),\"\",'7. Maintenance and accuracy'!H3)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I3),\"\",'7. Maintenance and accuracy'!I3)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J3),\"\",'7. Maintenance and accuracy'!J3)","v":""}]
["Maintenance and accuracy",7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.3","\tEnsure policies have appropriate document and version control.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E4),\"\",'7. Maintenance and accuracy'!E4)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F4),\"\",'7. Maintenance and accuracy'!F4)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G4),\"\",'7. Maintenance and accuracy'!G4)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H4),\"\",'7. Maintenance and accuracy'!H4)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I4),\"\",'7. Maintenance and accuracy'!I4)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J4),\"\",'7. Maintenance and accuracy'!J4)","v":""}]
["Maintenance and accuracy",7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.4","\tCommunicate policies to staff and make policies readily available for them to refer to.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E5),\"\",'7. Maintenance and accuracy'!E5)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F5),\"\",'7. Maintenance and accuracy'!F5)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G5),\"\",'7. Maintenance and accuracy'!G5)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H5),\"\",'7. Maintenance and accuracy'!H5)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I5),\"\",'7. Maintenance and accuracy'!I5)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J5),\"\",'7. Maintenance and accuracy'!J5)","v":""}]
["Maintenance and accuracy",7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.5","\tKeep policies up-to-date, particularly with any changes to data protection law.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E6),\"\",'7. Maintenance and accuracy'!E6)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F6),\"\",'7. Maintenance and accuracy'!F6)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G6),\"\",'7. Maintenance and accuracy'!G6)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H6),\"\",'7. Maintenance and accuracy'!H6)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I6),\"\",'7. Maintenance and accuracy'!I6)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J6),\"\",'7. Maintenance and accuracy'!J6)","v":""}]
["Maintenance and accuracy",7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.1","\tHave a process to inform third parties about any request for rectification, if you have shared inaccurate personal information with them.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E7),\"\",'7. Maintenance and accuracy'!E7)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F7),\"\",'7. Maintenance and accuracy'!F7)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G7),\"\",'7. Maintenance and accuracy'!G7)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H7),\"\",'7. Maintenance and accuracy'!H7)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I7),\"\",'7. Maintenance and accuracy'!I7)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J7),\"\",'7. Maintenance and accuracy'!J7)","v":""}]
["Maintenance and accuracy",{"$f":"B85","v":7.2},"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.2","\tDocument responsibilities and processes for rectification requests in contracts with processors.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E8),\"\",'7. Maintenance and accuracy'!E8)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F8),\"\",'7. Maintenance and accuracy'!F8)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G8),\"\",'7. Maintenance and accuracy'!G8)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H8),\"\",'7. Maintenance and accuracy'!H8)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I8),\"\",'7. Maintenance and accuracy'!I8)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J8),\"\",'7. Maintenance and accuracy'!J8)","v":""}]
["Maintenance and accuracy",7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.3","\tDocument responsibilities for rectification requests in sharing agreements with other controllers. ",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E9),\"\",'7. Maintenance and accuracy'!E9)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F9),\"\",'7. Maintenance and accuracy'!F9)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G9),\"\",'7. Maintenance and accuracy'!G9)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H9),\"\",'7. Maintenance and accuracy'!H9)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I9),\"\",'7. Maintenance and accuracy'!I9)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J9),\"\",'7. Maintenance and accuracy'!J9)","v":""}]
["Maintenance and accuracy",7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.4","\tMeasure performance and compliance metrics or key performance indicators for rectification requests (eg the number of requests received and the time taken to inform third parties).",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E10),\"\",'7. Maintenance and accuracy'!E10)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F10),\"\",'7. Maintenance and accuracy'!F10)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G10),\"\",'7. Maintenance and accuracy'!G10)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H10),\"\",'7. Maintenance and accuracy'!H10)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I10),\"\",'7. Maintenance and accuracy'!I10)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J10),\"\",'7. Maintenance and accuracy'!J10)","v":""}]
["Maintenance and accuracy",7.3,"The quality of information held in records or systems is reviewed regularly to ensure it is adequate for its purpose.","7.3.1","\tComplete data quality reviews to confirm that information is still accurate, adequate and not excessive for the purpose you are processing it for.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E11),\"\",'7. Maintenance and accuracy'!E11)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F11),\"\",'7. Maintenance and accuracy'!F11)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G11),\"\",'7. Maintenance and accuracy'!G11)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H11),\"\",'7. Maintenance and accuracy'!H11)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I11),\"\",'7. Maintenance and accuracy'!I11)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J11),\"\",'7. Maintenance and accuracy'!J11)","v":""}]
["Maintenance and accuracy",{"$f":"B89","v":7.3},"The quality of information held in records or systems is reviewed regularly to ensure it is adequate for its purpose.","7.3.2","\tTake appropriate actions to resolve data quality issues and update processes and staff after reviews.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E12),\"\",'7. Maintenance and accuracy'!E12)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F12),\"\",'7. Maintenance and accuracy'!F12)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G12),\"\",'7. Maintenance and accuracy'!G12)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H12),\"\",'7. Maintenance and accuracy'!H12)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I12),\"\",'7. Maintenance and accuracy'!I12)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J12),\"\",'7. Maintenance and accuracy'!J12)","v":""}]
["Maintenance and accuracy",7.4,"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.1","Train new staff on data quality at induction and refresh training periodically.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E13),\"\",'7. Maintenance and accuracy'!E13)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F13),\"\",'7. Maintenance and accuracy'!F13)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G13),\"\",'7. Maintenance and accuracy'!G13)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H13),\"\",'7. Maintenance and accuracy'!H13)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I13),\"\",'7. Maintenance and accuracy'!I13)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J13),\"\",'7. Maintenance and accuracy'!J13)","v":""}]
[{"$f":"A91","v":"Maintenance and accuracy"},7.4,"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.2","\tCommunicate data quality issues to staff to raise awareness (eg using posters, team meetings, reminder emails, and newsletters).",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E14),\"\",'7. Maintenance and accuracy'!E14)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F14),\"\",'7. Maintenance and accuracy'!F14)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G14),\"\",'7. Maintenance and accuracy'!G14)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H14),\"\",'7. Maintenance and accuracy'!H14)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I14),\"\",'7. Maintenance and accuracy'!I14)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J14),\"\",'7. Maintenance and accuracy'!J14)","v":""}]
["Maintenance and accuracy",7.4,"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.3","\tProvide feedback quickly to relevant staff on findings from data quality reviews.",{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!E15),\"\",'7. Maintenance and accuracy'!E15)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!F15),\"\",'7. Maintenance and accuracy'!F15)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!G15),\"\",'7. Maintenance and accuracy'!G15)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!H15),\"\",'7. Maintenance and accuracy'!H15)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!I15),\"\",'7. Maintenance and accuracy'!I15)","v":""},{"$f":"IF(ISBLANK('7. Maintenance and accuracy'!J15),\"\",'7. Maintenance and accuracy'!J15)","v":""}]
["Retention",8.1,"Storage periods for all personal information are documented in a retention schedule.","8.1.1","\tProduce a retention schedule that reflects business needs and legal requirements.",{"$f":"IF(ISBLANK('8. Retention'!E2),\"\",'8. Retention'!E2)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F2),\"\",'8. Retention'!F2)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G2),\"\",'8. Retention'!G2)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H2),\"\",'8. Retention'!H2)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I2),\"\",'8. Retention'!I2)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J2),\"\",'8. Retention'!J2)","v":""}]
[{"$f":"A94","v":"Retention"},{"$f":"B94","v":8.1},"Storage periods for all personal information are documented in a retention schedule.","8.1.2","Document in detail how long to keep each category of personal information for and why.",{"$f":"IF(ISBLANK('8. Retention'!E3),\"\",'8. Retention'!E3)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F3),\"\",'8. Retention'!F3)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G3),\"\",'8. Retention'!G3)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H3),\"\",'8. Retention'!H3)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I3),\"\",'8. Retention'!I3)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J3),\"\",'8. Retention'!J3)","v":""}]
["Retention",8.1,"Storage periods for all personal information are documented in a retention schedule.","8.1.3","\tDocument the actions to take after the retention period (eg anonymisation, archiving, or deletion).",{"$f":"IF(ISBLANK('8. Retention'!E4),\"\",'8. Retention'!E4)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F4),\"\",'8. Retention'!F4)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G4),\"\",'8. Retention'!G4)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H4),\"\",'8. Retention'!H4)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I4),\"\",'8. Retention'!I4)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J4),\"\",'8. Retention'!J4)","v":""}]
["Retention",8.1999999999999993,"The retention schedule is reviewed regularly to check it meets all necessary requirements.","8.2.1","\tRegularly review the retention schedule so it continues to meet business needs and legal requirements.",{"$f":"IF(ISBLANK('8. Retention'!E5),\"\",'8. Retention'!E5)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F5),\"\",'8. Retention'!F5)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G5),\"\",'8. Retention'!G5)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H5),\"\",'8. Retention'!H5)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I5),\"\",'8. Retention'!I5)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J5),\"\",'8. Retention'!J5)","v":""}]
["Retention",{"$f":"B97","v":8.1999999999999993},"The retention schedule is reviewed regularly to check it meets all necessary requirements.","8.2.2","\tUpdate the retention schedule quickly when a change is required.",{"$f":"IF(ISBLANK('8. Retention'!E6),\"\",'8. Retention'!E6)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F6),\"\",'8. Retention'!F6)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G6),\"\",'8. Retention'!G6)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H6),\"\",'8. Retention'!H6)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I6),\"\",'8. Retention'!I6)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J6),\"\",'8. Retention'!J6)","v":""}]
["Retention",8.3000000000000007,"The retention schedule and process is owned by an appropriate staff member.","8.3.1","\tAssign responsibility for the retention schedule and deletion process to an appropriate staff member(s).",{"$f":"IF(ISBLANK('8. Retention'!E7),\"\",'8. Retention'!E7)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F7),\"\",'8. Retention'!F7)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G7),\"\",'8. Retention'!G7)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H7),\"\",'8. Retention'!H7)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I7),\"\",'8. Retention'!I7)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J7),\"\",'8. Retention'!J7)","v":""}]
["Retention",{"$f":"B99","v":8.3000000000000007},"The retention schedule and process is owned by an appropriate staff member.","8.3.2","\tProvide specialised training for staff who handle retention or deletion. ",{"$f":"IF(ISBLANK('8. Retention'!E8),\"\",'8. Retention'!E8)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F8),\"\",'8. Retention'!F8)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G8),\"\",'8. Retention'!G8)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H8),\"\",'8. Retention'!H8)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I8),\"\",'8. Retention'!I8)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J8),\"\",'8. Retention'!J8)","v":""}]
["Retention",8.3000000000000007,"The retention schedule and process is owned by an appropriate staff member.","8.3.3","\tRecord specialist training requirements in a training needs analysis or training programme for staff who handle retention or deletion.",{"$f":"IF(ISBLANK('8. Retention'!E9),\"\",'8. Retention'!E9)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F9),\"\",'8. Retention'!F9)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G9),\"\",'8. Retention'!G9)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H9),\"\",'8. Retention'!H9)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I9),\"\",'8. Retention'!I9)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J9),\"\",'8. Retention'!J9)","v":""}]
["Retention",8.4,"Retained physical records are converted into electronic form, where possible, and physical copies are securely destroyed.","8.4.1","\tUse a third-party records management provider to scan physical records in bulk.",{"$f":"IF(ISBLANK('8. Retention'!E10),\"\",'8. Retention'!E10)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F10),\"\",'8. Retention'!F10)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G10),\"\",'8. Retention'!G10)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H10),\"\",'8. Retention'!H10)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I10),\"\",'8. Retention'!I10)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J10),\"\",'8. Retention'!J10)","v":""}]
["Retention",{"$f":"B102","v":8.4},"Retained physical records are converted into electronic form, where possible, and physical copies are securely destroyed.","8.4.2","\tKeep confirmation of the destruction of physical copies with the electronic copy, to help you respond to individual rights requests.",{"$f":"IF(ISBLANK('8. Retention'!E11),\"\",'8. Retention'!E11)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F11),\"\",'8. Retention'!F11)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G11),\"\",'8. Retention'!G11)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H11),\"\",'8. Retention'!H11)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I11),\"\",'8. Retention'!I11)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J11),\"\",'8. Retention'!J11)","v":""}]
["Retention",8.5,"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.1","\tDocument information weeding processes in policies.",{"$f":"IF(ISBLANK('8. Retention'!E12),\"\",'8. Retention'!E12)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F12),\"\",'8. Retention'!F12)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G12),\"\",'8. Retention'!G12)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H12),\"\",'8. Retention'!H12)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I12),\"\",'8. Retention'!I12)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J12),\"\",'8. Retention'!J12)","v":""}]
[{"$f":"A104","v":"Retention"},8.5,"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.2","\tRegularly complete weeding activities.",{"$f":"IF(ISBLANK('8. Retention'!E13),\"\",'8. Retention'!E13)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F13),\"\",'8. Retention'!F13)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G13),\"\",'8. Retention'!G13)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H13),\"\",'8. Retention'!H13)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I13),\"\",'8. Retention'!I13)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J13),\"\",'8. Retention'!J13)","v":""}]
["Retention",8.5,"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.3","\tEnsure staff understand the importance of weeding and how it supports compliance with data protection law.",{"$f":"IF(ISBLANK('8. Retention'!E14),\"\",'8. Retention'!E14)","v":""},{"$f":"IF(ISBLANK('8. Retention'!F14),\"\",'8. Retention'!F14)","v":""},{"$f":"IF(ISBLANK('8. Retention'!G14),\"\",'8. Retention'!G14)","v":""},{"$f":"IF(ISBLANK('8. Retention'!H14),\"\",'8. Retention'!H14)","v":""},{"$f":"IF(ISBLANK('8. Retention'!I14),\"\",'8. Retention'!I14)","v":""},{"$f":"IF(ISBLANK('8. Retention'!J14),\"\",'8. Retention'!J14)","v":""}]
["Disposal and deletion",9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.1","\tDelete electronic records containing personal information permanently in line with the retention schedule.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E2),\"\",'9. Diposal and deletion'!E2)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F2),\"\",'9. Diposal and deletion'!F2)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G2),\"\",'9. Diposal and deletion'!G2)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H2),\"\",'9. Diposal and deletion'!H2)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I2),\"\",'9. Diposal and deletion'!I2)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J2),\"\",'9. Diposal and deletion'!J2)","v":""}]
[{"$f":"A107","v":"Disposal and deletion"},{"$f":"B107","v":9.1},"Electronic records are disposed of in line with the retention schedule.","9.1.2","\tMove electronic records out of reach and restrict access, where system functionality prevents deletion or deletion isn't possible.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E3),\"\",'9. Diposal and deletion'!E3)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F3),\"\",'9. Diposal and deletion'!F3)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G3),\"\",'9. Diposal and deletion'!G3)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H3),\"\",'9. Diposal and deletion'!H3)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I3),\"\",'9. Diposal and deletion'!I3)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J3),\"\",'9. Diposal and deletion'!J3)","v":""}]
["Disposal and deletion",9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.3","\tObtain and log management approval prior to deleting records.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E4),\"\",'9. Diposal and deletion'!E4)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F4),\"\",'9. Diposal and deletion'!F4)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G4),\"\",'9. Diposal and deletion'!G4)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H4),\"\",'9. Diposal and deletion'!H4)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I4),\"\",'9. Diposal and deletion'!I4)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J4),\"\",'9. Diposal and deletion'!J4)","v":""}]
["Disposal and deletion",9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.4","\tHave a process to delete emails in line with the retention schedule.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E5),\"\",'9. Diposal and deletion'!E5)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F5),\"\",'9. Diposal and deletion'!F5)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G5),\"\",'9. Diposal and deletion'!G5)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H5),\"\",'9. Diposal and deletion'!H5)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I5),\"\",'9. Diposal and deletion'!I5)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J5),\"\",'9. Diposal and deletion'!J5)","v":""}]
["Disposal and deletion",9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.5","\tReport failure to delete electronic records in line with the retention schedule as an incident and take appropriate action.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E6),\"\",'9. Diposal and deletion'!E6)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F6),\"\",'9. Diposal and deletion'!F6)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G6),\"\",'9. Diposal and deletion'!G6)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H6),\"\",'9. Diposal and deletion'!H6)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I6),\"\",'9. Diposal and deletion'!I6)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J6),\"\",'9. Diposal and deletion'!J6)","v":""}]
["Disposal and deletion",9.1999999999999993,"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.1","\tUse and document secure disposal methods (eg device wiping, degaussing, or hardware shredding).",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E7),\"\",'9. Diposal and deletion'!E7)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F7),\"\",'9. Diposal and deletion'!F7)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G7),\"\",'9. Diposal and deletion'!G7)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H7),\"\",'9. Diposal and deletion'!H7)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I7),\"\",'9. Diposal and deletion'!I7)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J7),\"\",'9. Diposal and deletion'!J7)","v":""}]
["Disposal and deletion",{"$f":"B112","v":9.1999999999999993},"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.2","\tStore electronic devices or hardware awaiting destruction securely (eg in a locked area with restricted access).",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E8),\"\",'9. Diposal and deletion'!E8)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F8),\"\",'9. Diposal and deletion'!F8)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G8),\"\",'9. Diposal and deletion'!G8)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H8),\"\",'9. Diposal and deletion'!H8)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I8),\"\",'9. Diposal and deletion'!I8)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J8),\"\",'9. Diposal and deletion'!J8)","v":""}]
["Disposal and deletion",9.1999999999999993,"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.3","\tKeep a log of all devices awaiting destruction and their location.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E9),\"\",'9. Diposal and deletion'!E9)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F9),\"\",'9. Diposal and deletion'!F9)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G9),\"\",'9. Diposal and deletion'!G9)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H9),\"\",'9. Diposal and deletion'!H9)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I9),\"\",'9. Diposal and deletion'!I9)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J9),\"\",'9. Diposal and deletion'!J9)","v":""}]
["Disposal and deletion",9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.1","\tDestroy physical records containing personal information permanently in line with the retention schedule.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E10),\"\",'9. Diposal and deletion'!E10)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F10),\"\",'9. Diposal and deletion'!F10)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G10),\"\",'9. Diposal and deletion'!G10)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H10),\"\",'9. Diposal and deletion'!H10)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I10),\"\",'9. Diposal and deletion'!I10)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J10),\"\",'9. Diposal and deletion'!J10)","v":""}]
["Disposal and deletion",{"$f":"B115","v":9.3000000000000007},"Physical records are disposed of in line with the retention schedule.","9.3.2","\tDestroy records held in record archives, satellite locations, or by third-party storage providers.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E11),\"\",'9. Diposal and deletion'!E11)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F11),\"\",'9. Diposal and deletion'!F11)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G11),\"\",'9. Diposal and deletion'!G11)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H11),\"\",'9. Diposal and deletion'!H11)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I11),\"\",'9. Diposal and deletion'!I11)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J11),\"\",'9. Diposal and deletion'!J11)","v":""}]
["Disposal and deletion",9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.3","\tObtain and log management approval prior to destroying records.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E12),\"\",'9. Diposal and deletion'!E12)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F12),\"\",'9. Diposal and deletion'!F12)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G12),\"\",'9. Diposal and deletion'!G12)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H12),\"\",'9. Diposal and deletion'!H12)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I12),\"\",'9. Diposal and deletion'!I12)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J12),\"\",'9. Diposal and deletion'!J12)","v":""}]
["Disposal and deletion",9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.4","Report failure to delete physical records as an incident and take appropriate action.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E13),\"\",'9. Diposal and deletion'!E13)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F13),\"\",'9. Diposal and deletion'!F13)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G13),\"\",'9. Diposal and deletion'!G13)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H13),\"\",'9. Diposal and deletion'!H13)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I13),\"\",'9. Diposal and deletion'!I13)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J13),\"\",'9. Diposal and deletion'!J13)","v":""}]
["Disposal and deletion",9.4,"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.1","\tUse and document secure disposal methods (eg cross-cut or micro-cut shredding).",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E14),\"\",'9. Diposal and deletion'!E14)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F14),\"\",'9. Diposal and deletion'!F14)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G14),\"\",'9. Diposal and deletion'!G14)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H14),\"\",'9. Diposal and deletion'!H14)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I14),\"\",'9. Diposal and deletion'!I14)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J14),\"\",'9. Diposal and deletion'!J14)","v":""}]
["Disposal and deletion",{"$f":"B119","v":9.4},"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.2","\tStore physical records awaiting destruction securely (eg in a locked area with restricted access).",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E15),\"\",'9. Diposal and deletion'!E15)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F15),\"\",'9. Diposal and deletion'!F15)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G15),\"\",'9. Diposal and deletion'!G15)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H15),\"\",'9. Diposal and deletion'!H15)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I15),\"\",'9. Diposal and deletion'!I15)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J15),\"\",'9. Diposal and deletion'!J15)","v":""}]
["Disposal and deletion",9.4,"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.3","\tKeep a log of all physical records awaiting destruction and their locations.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E16),\"\",'9. Diposal and deletion'!E16)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F16),\"\",'9. Diposal and deletion'!F16)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G16),\"\",'9. Diposal and deletion'!G16)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H16),\"\",'9. Diposal and deletion'!H16)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I16),\"\",'9. Diposal and deletion'!I16)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J16),\"\",'9. Diposal and deletion'!J16)","v":""}]
["Disposal and deletion",9.5,"Appropriate contracts are in place with all third parties used to dispose of personal information.","9.5.1","\tEnsure contracts are signed by an appropriate senior manager.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E17),\"\",'9. Diposal and deletion'!E17)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F17),\"\",'9. Diposal and deletion'!F17)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G17),\"\",'9. Diposal and deletion'!G17)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H17),\"\",'9. Diposal and deletion'!H17)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I17),\"\",'9. Diposal and deletion'!I17)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J17),\"\",'9. Diposal and deletion'!J17)","v":""}]
["Disposal and deletion",{"$f":"B122","v":9.5},"Appropriate contracts are in place with all third parties used to dispose of personal information.","9.5.2","\tEnsure contracts include all required clauses and details, including security measures, accountability, and your right to audit providers.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E18),\"\",'9. Diposal and deletion'!E18)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F18),\"\",'9. Diposal and deletion'!F18)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G18),\"\",'9. Diposal and deletion'!G18)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H18),\"\",'9. Diposal and deletion'!H18)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I18),\"\",'9. Diposal and deletion'!I18)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J18),\"\",'9. Diposal and deletion'!J18)","v":""}]
["Disposal and deletion",9.6,"Evidence of secure disposal is obtained from third parties used to dispose of personal information.","9.6.1","\tCheck periodically that the security of third-party services is to the agreed standard.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E19),\"\",'9. Diposal and deletion'!E19)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F19),\"\",'9. Diposal and deletion'!F19)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G19),\"\",'9. Diposal and deletion'!G19)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H19),\"\",'9. Diposal and deletion'!H19)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I19),\"\",'9. Diposal and deletion'!I19)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J19),\"\",'9. Diposal and deletion'!J19)","v":""}]
[{"$f":"A124","v":"Disposal and deletion"},9.6,"Evidence of secure disposal is obtained from third parties used to dispose of personal information.","9.6.2","\tAssign a staff member to check destruction certificates match what you sent for destruction.",{"$f":"IF(ISBLANK('9. Diposal and deletion'!E20),\"\",'9. Diposal and deletion'!E20)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!F20),\"\",'9. Diposal and deletion'!F20)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!G20),\"\",'9. Diposal and deletion'!G20)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!H20),\"\",'9. Diposal and deletion'!H20)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!I20),\"\",'9. Diposal and deletion'!I20)","v":""},{"$f":"IF(ISBLANK('9. Diposal and deletion'!J20),\"\",'9. Diposal and deletion'!J20)","v":""}]
["Right to be forgotten",10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.1","Document how to handle requests in sufficient detail in policies, including who oversees the request process and how.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E2),\"\",'10. Right to be forgotten'!E2)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F2),\"\",'10. Right to be forgotten'!F2)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G2),\"\",'10. Right to be forgotten'!G2)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H2),\"\",'10. Right to be forgotten'!H2)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I2),\"\",'10. Right to be forgotten'!I2)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J2),\"\",'10. Right to be forgotten'!J2)","v":""}]
[{"$f":"A126","v":"Right to be forgotten"},10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.2","Document how to determine if there is a compelling reason to continue processing information, as part of the request.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E3),\"\",'10. Right to be forgotten'!E3)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F3),\"\",'10. Right to be forgotten'!F3)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G3),\"\",'10. Right to be forgotten'!G3)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H3),\"\",'10. Right to be forgotten'!H3)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I3),\"\",'10. Right to be forgotten'!I3)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J3),\"\",'10. Right to be forgotten'!J3)","v":""}]
["Right to be forgotten",10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.3","Have a process to inform third parties about any request for erasure, if you delete personal information that you have shared with them.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E4),\"\",'10. Right to be forgotten'!E4)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F4),\"\",'10. Right to be forgotten'!F4)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G4),\"\",'10. Right to be forgotten'!G4)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H4),\"\",'10. Right to be forgotten'!H4)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I4),\"\",'10. Right to be forgotten'!I4)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J4),\"\",'10. Right to be forgotten'!J4)","v":""}]
["Right to be forgotten",10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.4","Give these policies appropriate document and version control.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E5),\"\",'10. Right to be forgotten'!E5)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F5),\"\",'10. Right to be forgotten'!F5)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G5),\"\",'10. Right to be forgotten'!G5)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H5),\"\",'10. Right to be forgotten'!H5)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I5),\"\",'10. Right to be forgotten'!I5)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J5),\"\",'10. Right to be forgotten'!J5)","v":""}]
["Right to be forgotten",10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.5","\tCommunicate these policies to staff who deal with requests and make policies readily available for them to refer to.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E6),\"\",'10. Right to be forgotten'!E6)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F6),\"\",'10. Right to be forgotten'!F6)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G6),\"\",'10. Right to be forgotten'!G6)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H6),\"\",'10. Right to be forgotten'!H6)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I6),\"\",'10. Right to be forgotten'!I6)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J6),\"\",'10. Right to be forgotten'!J6)","v":""}]
["Right to be forgotten",10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.6","Keep policies up-to-date, particularly with any changes to data protection law.",{"$f":"IF(ISBLANK('10. Right to be forgotten'!E7),\"\",'10. Right to be forgotten'!E7)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!F7),\"\",'10. Right to be forgotten'!F7)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!G7),\"\",'10. Right to be forgotten'!G7)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!H7),\"\",'10. Right to be forgotten'!H7)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!I7),\"\",'10. Right to be forgotten'!I7)","v":""},{"$f":"IF(ISBLANK('10. Right to be forgotten'!J7),\"\",'10. Right to be forgotten'!J7)","v":""}]

{"sheet":"Tables & graphs","index":3,"n_rows":27,"n_cols":12,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Records management framework","2. Data collection","3. Record creation","4. Data mapping and recording","5. Access","6. Movement and retrieval","7. Maintenance and accuracy","8. Retention","9. Disposal and deletion","10. Right to be forgotten","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Records management framework'!E:E,A2)","v":0},{"$f":"COUNTIF('2. Data collection'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Record creation '!E:E,A2)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Access'!E:E,A2)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!E:E,A2)","v":0},{"$f":"COUNTIF('8. Retention'!E:E,A2)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!E:E,A2)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!E:E,A2)","v":0},{"$f":"SUM(B2:K2)","v":0}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Records management framework'!E:E,A3)","v":0},{"$f":"COUNTIF('2. Data collection'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Record creation '!E:E,A3)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Access'!E:E,A3)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!E:E,A3)","v":0},{"$f":"COUNTIF('8. Retention'!E:E,A3)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!E:E,A3)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!E:E,A3)","v":0},{"$f":"SUM(B3:K3)","v":0}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Records management framework'!E:E,A4)","v":0},{"$f":"COUNTIF('2. Data collection'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Record creation '!E:E,A4)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Access'!E:E,A4)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!E:E,A4)","v":0},{"$f":"COUNTIF('8. Retention'!E:E,A4)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!E:E,A4)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!E:E,A4)","v":0},0]
["Not Applicable",{"$f":"COUNTIF('1. Records management framework'!E:E,A5)","v":0},{"$f":"COUNTIF('2. Data collection'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Record creation '!E:E,A5)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Access'!E:E,A5)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!E:E,A5)","v":0},{"$f":"COUNTIF('8. Retention'!E:E,A5)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!E:E,A5)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!E:E,A5)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Records management framework'!E2:E15)","v":14},{"$f":"COUNTBLANK('2. Data collection'!E2:E9)","v":8},{"$f":"COUNTBLANK('3. Record creation '!E2:E7)","v":6},{"$f":"COUNTBLANK('4. Data mapping and recording'!E2:E17)","v":16},{"$f":"COUNTBLANK('5. Access'!E2:E16)","v":15},{"$f":"COUNTBLANK('6. Movement and retrieval'!E2:E19)","v":18},{"$f":"COUNTBLANK('7. Maintenance and accuracy'!E2:E15)","v":14},{"$f":"COUNTBLANK('8. Retention'!E2:E14)","v":13},{"$f":"COUNTBLANK('9. Diposal and deletion'!E2:E20)","v":19},{"$f":"COUNTBLANK('10. Right to be forgotten'!E2:E7)","v":6},129]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Records management framework","2. Data collection","3. Record creation","4. Data mapping and recording","5. Access","6. Movement and retrieval","7. Maintenance and accuracy","8. Retention","9. Disposal and deletion","10. Right to be forgotten","Total"]
["Not started",{"$f":"COUNTIF('1. Records management framework'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Data collection'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Record creation '!I:I,A18)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Access'!I:I,A18)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!I:I,A18)","v":0},{"$f":"COUNTIF('8. Retention'!I:I,A18)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!I:I,A18)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!I:I,A18)","v":0},{"$f":"SUM(B18:K18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Records management framework'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Data collection'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Record creation '!I:I,A19)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Access'!I:I,A19)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!I:I,A19)","v":0},{"$f":"COUNTIF('8. Retention'!I:I,A19)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!I:I,A19)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!I:I,A19)","v":0},{"$f":"SUM(B19:K19)","v":0}]
["On track",{"$f":"COUNTIF('1. Records management framework'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Data collection'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Record creation '!I:I,A20)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Access'!I:I,A20)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!I:I,A20)","v":0},{"$f":"COUNTIF('8. Retention'!I:I,A20)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!I:I,A20)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Records management framework'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Data collection'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Record creation '!I:I,A21)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Access'!I:I,A21)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!I:I,A21)","v":0},{"$f":"COUNTIF('8. Retention'!I:I,A21)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!I:I,A21)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Records management framework'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Data collection'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Record creation '!I:I,A22)","v":0},{"$f":"COUNTIF('4. Data mapping and recording'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Access'!I:I,A22)","v":0},{"$f":"COUNTIF('6. Movement and retrieval'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Maintenance and accuracy'!I:I,A22)","v":0},{"$f":"COUNTIF('8. Retention'!I:I,A22)","v":0},{"$f":"COUNTIF('9. Diposal and deletion'!I:I,A22)","v":0},{"$f":"COUNTIF('10. Right to be forgotten'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Records management framework'!I2:I15)","v":14},{"$f":"COUNTBLANK('2. Data collection'!I2:I9)","v":8},{"$f":"COUNTBLANK('3. Record creation '!I2:I7)","v":6},{"$f":"COUNTBLANK('4. Data mapping and recording'!I2:I17)","v":16},{"$f":"COUNTBLANK('5. Access'!I2:I16)","v":15},{"$f":"COUNTBLANK('6. Movement and retrieval'!I2:I19)","v":18},{"$f":"COUNTBLANK('7. Maintenance and accuracy'!I2:I15)","v":14},{"$f":"COUNTBLANK('8. Retention'!I2:I14)","v":13},{"$f":"COUNTBLANK('9. Diposal and deletion'!I2:I20)","v":19},{"$f":"COUNTBLANK('10. Right to be forgotten'!I2:I7)","v":6},129]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:K18)","v":0},{"$f":"SUM(B19:K19)","v":0},{"$f":"SUM(B20:K20)","v":0},{"$f":"SUM(B21:K21)","v":0},{"$f":"SUM(B22:K22)","v":0},{"$f":"SUM(B23:K23)","v":129}]

{"sheet":"Lookup","index":4,"n_rows":9,"n_cols":7,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Fully meeting our expectation",null,null,null,"Not started",null,"Not started"]
["Partially meeting our expectation",null,null,null,"Action rejected",null,"In progress"]
["Not meeting our expectation",null,null,null,"On track",null,"Overdue"]
["Not Applicable",null,null,null,"Overdue",null,"Completed"]
[null,null,null,null,"Completed"]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-17"}]

{"sheet":"1. Records management framework","index":5,"n_rows":15,"n_cols":10,"rows_kept":15,"cut":false,"hidden":false,"merged":[[1,1,4,1],[1,0,4,0],[5,1,10,1],[5,0,10,0],[11,0,14,0],[11,1,14,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.1"," Assign strategic responsibility and oversight of records management to an appropriate executive board member (eg Senior Information Risk Owner (SIRO) or equivalent)."]
[{"$f":"A2","v":1.1000000000000001},"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.2","\tAssign operational responsibility and development of records management to an appropriate manager."]
[1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.3","\tAssign responsibility for implementing records management processes to local business areas (eg Information Asset Owners (IAOs), Information Asset Administrators (IAAs) and department managers)."]
[1.1000000000000001,"Records management responsibilities are allocated and the records management function and processes are subject to effective oversight at a senior level.","1.1.4","\tHave a regular steering group or meeting that monitors records management processes and functions and includes or reports to senior management."]
[1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.1","\tDocument each records management process in sufficient detail in policies, including who oversees processes and how."]
[{"$f":"A6","v":1.2000000000000002},"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.2","\tEnsure policies have appropriate document and version control."]
[1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.3","\tEnsure policies follow a standard format."]
[1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.4","\tEnsure policies are approved by senior management."]
[1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.5","\tCommunicate these policies to staff who create or manage records, and make policies readily available for them to refer to."]
[1.2000000000000002,"Records management processes are documented in policies, approved by senior management, and reviewed periodically to align to latest guidelines.","1.2.6","\tKeep policies up-to-date, particularly with any changes to data protection law."]
[1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.1","\tTrain new staff on records management at induction."]
[{"$f":"A12","v":1.3000000000000003},"Staff receive formal records management training, and good records management practices are promoted.","1.3.2","\tProvide refresher training on records management processes to all staff periodically."]
[1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.3","\tTrack training completion and report it to senior management."]
[1.3000000000000003,"Staff receive formal records management training, and good records management practices are promoted.","1.3.4","\tGet input into training content from records management managers and subject matter experts."]

{"sheet":"2. Data collection","index":6,"n_rows":9,"n_cols":10,"rows_kept":9,"cut":false,"hidden":false,"merged":[[1,1,3,1],[1,0,3,0],[4,1,8,1],[4,0,8,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[2.1,"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.1","\tPublish privacy information that includes all the information required by data protection law."]
[{"$f":"A2","v":2.1},"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.2","\tProvide privacy information at the point that you collect personal information."]
[2.1,"Fair processing information is comprehensive and actively communicated to people at the point that data is collected.","2.1.3","\tProduce privacy information in a variety of formats (eg posters and leaflets), in addition to online privacy notices."]
[2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.1","\tPresent privacy information clearly and prominently on your website or in another appropriate format at the point that you collect it."]
[{"$f":"A5","v":2.2000000000000002},"Fair processing information is in understandable and accessible languages and formats.","2.2.2","\tProvide privacy information in a layered format (eg summaries at the top with further detailed information below)."]
[2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.3","\tProvide privacy information in different languages or styles to ensure people can understand it, including separate age-appropriate notices, where relevant."]
[2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.4","\tHave the ability to provide privacy information in more accessible formats (eg in braille or large font)."]
[2.2000000000000002,"Fair processing information is in understandable and accessible languages and formats.","2.2.5","\tUse clear, plain, non-technical language when explaining processing."]

{"sheet":"3. Record creation ","index":7,"n_rows":7,"n_cols":10,"rows_kept":7,"cut":false,"hidden":false,"merged":[[1,1,3,1],[1,0,3,0],[4,1,6,1],[4,0,6,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons fo Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[3.1,"Processes for creating records or documented information are in place and outlined in policies.","3.1.1","\tDocument record creation processes in sufficient detail in policies, including document management protocols, metadata use, and record formatting and classification."]
[{"$f":"A2","v":3.1},"Processes for creating records or documented information are in place and outlined in policies.","3.1.2","\tHighlight changes to processes clearly in policies (eg in a change history). "]
[3.1,"Processes for creating records or documented information are in place and outlined in policies.","3.1.3","\tCommunicate processes to staff who create records and make policies readily available for them to refer to."]
[3.2,"Records are appropriately identified and classified.","3.2.1","\tAssign appropriate security classification to records and personal information."]
[{"$f":"A5","v":3.2},"Records are appropriately identified and classified.","3.2.2","\tClearly identify and describe records and personal information (eg in file names and metadata)."]
[3.2,"Records are appropriately identified and classified.","3.2.3","\tDocument classification and identification processes in sufficient detail in policies, including document management protocols, metadata use, and record formatting."]

{"sheet":"4. Data mapping and recording","index":8,"n_rows":17,"n_cols":10,"rows_kept":17,"cut":false,"hidden":false,"merged":[[1,0,5,0],[1,1,5,1],[6,0,9,0],[6,1,9,1],[10,0,16,0],[10,1,16,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYY)"]
[4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.1","\tComplete a comprehensive information audit across all areas or departments."]
[{"$f":"A2","v":4.0999999999999996},"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.2","Produce an information flow map based on the information audit."]
[4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.3","\tRepeat the information audit and review the information flow map regularly to capture changes."]
[4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.4","\tLog details about information assets in an information asset register."]
[4.0999999999999996,"A data flow mapping exercise is undertaken to document the data that flows in, around, and out of information processing systems or services.","4.1.5","\tAssign responsibilities for maintaining and amending the information asset register."]
[4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.1","\tHave a controlled inventory or register of all records."]
[{"$f":"A7","v":4.2},"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.2","\tKeep the inventory or register updated."]
[4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.3","\tAudit the inventory or register regularly to ensure it is accurate."]
[4.2,"An inventory or asset register is in place which includes details of records held, the information they contain, the format, and their value.","4.2.4","\tUse the inventory or register to inform records management practices."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.1","\tUpdate the ROPA if there are any changes to the inventory or register of information flows to ensure details match."]
[{"$f":"A11","v":4.3},"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.2","\tDocument the purpose, categories of people, and categories of personal information, for each processing activity in your ROPA and whether you are a controller, joint controller or processor."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.3","\tDocument the lawful basis, and additional conditions, if required, for each processing activity in your ROPA."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.4","\tDocument the source of personal information you process, where and how you store it, and the retention period, for each processing activity in your ROPA."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.5","\tDocument the technical and organisational security measures for each processing activity in your ROPA."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.6","\tDocument the recipients of shared information, and safeguards and adequacy decisions if information is transferred internationally, for each processing activity in your ROPA."]
[4.3,"The Record of processing activities (ROPA) includes details of all processing, informed by data flow mapping exercises. ","4.3.7","\tInclude links to other relevant information (eg consent logs, third-party contracts, data protection impact assessments (DPIA), and personal data breach reports)."]

{"sheet":"5. Access","index":9,"n_rows":16,"n_cols":10,"rows_kept":16,"cut":false,"hidden":false,"merged":[[13,1,15,1],[13,0,15,0],[1,1,3,1],[1,0,3,0],[4,1,6,1],[4,0,6,0],[7,0,12,0],[7,1,12,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"Access controls are in place to prevent unauthorised access to physical records.","5.1.1","\tKeep physical records in locked rooms, cabinets, cupboards, or drawers."]
[{"$f":"A2","v":5.0999999999999996},"Access controls are in place to prevent unauthorised access to physical records.","5.1.2","\tHave an access log to show who has accessed physical records."]
[5.0999999999999996,"Access controls are in place to prevent unauthorised access to physical records.","5.1.3","\tEnsure staff are aware that they should not leave records unattended without locking them away."]
[5.2,"The security of physical records storage areas and buildings is periodically audited.","5.2.1","\tReview the security and integrity of buildings and records storage areas regularly as part of internal and external audit programmes."]
[{"$f":"A5","v":5.2},"The security of physical records storage areas and buildings is periodically audited.","5.2.2","\tReview the security and integrity of third-party records storage areas and premises periodically."]
[5.2,"The security of physical records storage areas and buildings is periodically audited.","5.2.3","\tDocument in contracts the right to audit third-party records storage providers."]
[5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.1","\tDocument access control processes in a policy."]
[{"$f":"A8","v":5.3},"Access controls are in place to prevent unauthorised access to electronic records.","5.3.2","\tGet input from the Records Manager into access control processes."]
[5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.3","\tAssign access rights based on documented job role profiles."]
[5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.4","\tHave a process to quickly grant, amend, and remove access rights to new starters, movers, and leavers."]
[5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.5","\tEnsure access control measures that are detailed in policies include appropriate technical solutions (eg password rules, anti-malware and virus protection, firewall controls and vulnerability testing)."]
[5.3,"Access controls are in place to prevent unauthorised access to electronic records.","5.3.6","\tMonitor systems and records access regularly to identify inappropriate or unauthorised access."]
[5.4,"User access permissions for electronic records is logged and periodically reviewed.","5.4.1","\tLog all access rights granted."]
[{"$f":"A14","v":5.4},"User access permissions for electronic records is logged and periodically reviewed.","5.4.2","\tReview all access rights periodically."]
[5.4,"User access permissions for electronic records is logged and periodically reviewed.","5.4.3","\tHave a process to remove access or deactivate user accounts after a period of inactivity."]

{"sheet":"6. Movement and retrieval","index":10,"n_rows":19,"n_cols":10,"rows_kept":19,"cut":false,"hidden":false,"merged":[[1,1,2,1],[1,0,2,0],[3,1,4,1],[3,0,4,0],[5,0,6,0],[5,1,6,1],[7,1,8,1],[7,0,8,0],[9,1,15,1],[9,0,15,0],[16,0,18,0],[16,1,18,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[6.1,"The whereabouts of physical records are known at all times and the movement of records between storage and office areas is logged and tracked to help control and provide an audit trail of all record transactions.","6.1.1","\tHave a process or system to log the current locations of all physical records."]
[{"$f":"A2","v":6.1},"The whereabouts of physical records are known at all times and the movement of records between storage and office areas is logged and tracked to help control and provide an audit trail of all record transactions.","6.1.2","\tTrack the movement, transfer, and access to any physical records."]
[6.2,"Records stored off-site are indexed with unique references to enable accurate retrieval and subsequent tracking.","6.2.1","Document what referencing or indexing system is used."]
[{"$f":"A4","v":6.2},"Records stored off-site are indexed with unique references to enable accurate retrieval and subsequent tracking.","6.2.2","\tLog the location of records stored off-site using the index reference."]
[6.3,"Retrieval and tracking mechanisms are checked to ensure they remain effective.","6.3.1","\tMeasure performance metrics or key performance indicators for record retrieval and tracking mechanisms (eg the time taken to retrieve records or the number of records away from their assigned location for an extended time)."]
[{"$f":"A6","v":6.3},"Retrieval and tracking mechanisms are checked to ensure they remain effective.","6.3.2","\tCheck or periodically audit that record locations are accurate."]
[6.4,"Systems have the functionality to easily locate and retrieve electronic records.","6.4.1","\tEmbed search functionality into system design from the outset."]
[{"$f":"A8","v":6.4},"Systems have the functionality to easily locate and retrieve electronic records.","6.4.2","\tUse naming conventions, metadata, and data labels so staff can easily locate and retrieve electronic records."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.1","\tDocument security arrangements for physical records taken off-site in records management and remote working policies."]
[{"$f":"A10","v":6.5},"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.2","\tLog records that are taken off-site and who by."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.3","\tEnsure physical records are unmarked, transported securely in a locked case or bag, and not left unattended on public transport or in hotel rooms."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.4","\tAssess the risks of records being routinely taken off-site before they are removed."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.5","\tEnsure records created off-site or at home are kept secure, returned, or destroyed."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.6","\tDocument how staff should securely keep and destroy records when working from home."]
[6.5,"Records are stored securely when being transported, held off-site and when remote or home-working.","6.5.7","\tDocument how staff should securely keep and destroy records when working from home."]
[6.6,"Records are transferred securely internally or externally to third parties.","6.6.1","\tSecure physical records that are transferred externally by post or courier."]
[{"$f":"A17","v":6.6},"Records are transferred securely internally or externally to third parties.","6.6.2","\tSecure electronic records that are transferred internally or externally (eg by using encryption, secure file transfer protocol or online secure file sharing areas)."]
[6.6,"Records are transferred securely internally or externally to third parties.","6.6.3","\tDocument information transfer policies or rules in policies and communicate them clearly to all staff."]

{"sheet":"7. Maintenance and accuracy","index":11,"n_rows":15,"n_cols":10,"rows_kept":15,"cut":false,"hidden":false,"merged":[[12,1,14,1],[12,0,14,0],[1,0,5,0],[1,1,5,1],[6,1,9,1],[6,0,9,0],[10,1,11,1],[10,0,11,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.1","\tDocument how to handle rectification requests in sufficient detail in policies, including who oversees the request process and how."]
[{"$f":"A2","v":7.1},"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.2","\tHave a process to determine whether information is inaccurate, and how to correct it quickly or document the inaccuracy, if you can't rectify it."]
[7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.3","\tEnsure policies have appropriate document and version control."]
[7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.4","\tCommunicate policies to staff and make policies readily available for them to refer to."]
[7.1,"Processes are in place to allow people to challenge the accuracy of information held about them and to have it corrected, where appropriate.","7.1.5","\tKeep policies up-to-date, particularly with any changes to data protection law."]
[7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.1","\tHave a process to inform third parties about any request for rectification, if you have shared inaccurate personal information with them."]
[{"$f":"A7","v":7.2},"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.2","\tDocument responsibilities and processes for rectification requests in contracts with processors."]
[7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.3","\tDocument responsibilities for rectification requests in sharing agreements with other controllers. "]
[7.2,"Processes are in place to inform third parties quickly if inaccurate information has been shared with them.","7.2.4","\tMeasure performance and compliance metrics or key performance indicators for rectification requests (eg the number of requests received and the time taken to inform third parties)."]
[7.3,"The quality of information held in records or systems is reviewed regularly to ensure it is adequate for its purpose.","7.3.1","\tComplete data quality reviews to confirm that information is still accurate, adequate and not excessive for the purpose you are processing it for."]
[{"$f":"A11","v":7.3},"The quality of information held in records or systems is reviewed regularly to ensure it is adequate for its purpose.","7.3.2","\tTake appropriate actions to resolve data quality issues and update processes and staff after reviews."]
[7.4,"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.1","Train new staff on data quality at induction and refresh training periodically."]
[{"$f":"A13","v":7.4},"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.2","\tCommunicate data quality issues to staff to raise awareness (eg using posters, team meetings, reminder emails, and newsletters)."]
[7.4,"There are ongoing awareness campaigns and training for staff to emphasise the importance of good data quality, and feedback is given following data quality checks.","7.4.3","\tProvide feedback quickly to relevant staff on findings from data quality reviews."]

{"sheet":"8. Retention","index":12,"n_rows":14,"n_cols":10,"rows_kept":14,"cut":false,"hidden":false,"merged":[[9,0,10,0],[9,1,10,1],[11,1,13,1],[11,0,13,0],[1,0,3,0],[1,1,3,1],[4,0,5,0],[4,1,5,1],[6,0,8,0],[6,1,8,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[8.1,"Storage periods for all personal information are documented in a retention schedule.","8.1.1","\tProduce a retention schedule that reflects business needs and legal requirements."]
[{"$f":"A2","v":8.1},"Storage periods for all personal information are documented in a retention schedule.","8.1.2","Document in detail how long to keep each category of personal information for and why."]
[8.1,"Storage periods for all personal information are documented in a retention schedule.","8.1.3","\tDocument the actions to take after the retention period (eg anonymisation, archiving, or deletion)."]
[8.1999999999999993,"The retention schedule is reviewed regularly to check it meets all necessary requirements.","8.2.1","\tRegularly review the retention schedule so it continues to meet business needs and legal requirements."]
[{"$f":"A5","v":8.1999999999999993},"The retention schedule is reviewed regularly to check it meets all necessary requirements.","8.2.2","\tUpdate the retention schedule quickly when a change is required."]
[8.3000000000000007,"The retention schedule and process is owned by an appropriate staff member.","8.3.1","\tAssign responsibility for the retention schedule and deletion process to an appropriate staff member(s)."]
[{"$f":"A7","v":8.3000000000000007},"The retention schedule and process is owned by an appropriate staff member.","8.3.2","\tProvide specialised training for staff who handle retention or deletion. "]
[8.3000000000000007,"The retention schedule and process is owned by an appropriate staff member.","8.3.3","\tRecord specialist training requirements in a training needs analysis or training programme for staff who handle retention or deletion."]
[8.4,"Retained physical records are converted into electronic form, where possible, and physical copies are securely destroyed.","8.4.1","\tUse a third-party records management provider to scan physical records in bulk."]
[{"$f":"A10","v":8.4},"Retained physical records are converted into electronic form, where possible, and physical copies are securely destroyed.","8.4.2","\tKeep confirmation of the destruction of physical copies with the electronic copy, to help you respond to individual rights requests."]
[8.5,"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.1","\tDocument information weeding processes in policies."]
[{"$f":"A12","v":8.5},"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.2","\tRegularly complete weeding activities."]
[8.5,"Information or records are weeded periodically to prevent inaccuracies or excessive retention.","8.5.3","\tEnsure staff understand the importance of weeding and how it supports compliance with data protection law."]

{"sheet":"9. Diposal and deletion","index":13,"n_rows":20,"n_cols":10,"rows_kept":20,"cut":false,"hidden":false,"merged":[[1,0,5,0],[1,1,5,1],[6,1,8,1],[6,0,8,0],[9,1,12,1],[9,0,12,0],[13,1,15,1],[13,0,15,0],[16,1,17,1],[16,0,17,0],[18,1,19,1],[18,0,19,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.1","\tDelete electronic records containing personal information permanently in line with the retention schedule."]
[{"$f":"A2","v":9.1},"Electronic records are disposed of in line with the retention schedule.","9.1.2","\tMove electronic records out of reach and restrict access, where system functionality prevents deletion or deletion isn't possible."]
[9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.3","\tObtain and log management approval prior to deleting records."]
[9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.4","\tHave a process to delete emails in line with the retention schedule."]
[9.1,"Electronic records are disposed of in line with the retention schedule.","9.1.5","\tReport failure to delete electronic records in line with the retention schedule as an incident and take appropriate action."]
[9.1999999999999993,"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.1","\tUse and document secure disposal methods (eg device wiping, degaussing, or hardware shredding)."]
[{"$f":"A7","v":9.1999999999999993},"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.2","\tStore electronic devices or hardware awaiting destruction securely (eg in a locked area with restricted access)."]
[9.1999999999999993,"Electronic records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.2.3","\tKeep a log of all devices awaiting destruction and their location."]
[9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.1","\tDestroy physical records containing personal information permanently in line with the retention schedule."]
[{"$f":"A10","v":9.3000000000000007},"Physical records are disposed of in line with the retention schedule.","9.3.2","\tDestroy records held in record archives, satellite locations, or by third-party storage providers."]
[9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.3","\tObtain and log management approval prior to destroying records."]
[9.3000000000000007,"Physical records are disposed of in line with the retention schedule.","9.3.4","Report failure to delete physical records as an incident and take appropriate action."]
[9.4,"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.1","\tUse and document secure disposal methods (eg cross-cut or micro-cut shredding)."]
[{"$f":"A14","v":9.4},"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.2","\tStore physical records awaiting destruction securely (eg in a locked area with restricted access)."]
[9.4,"Physical records are destroyed using appropriate methods that prevent disclosure before, during, and after disposal.","9.4.3","\tKeep a log of all physical records awaiting destruction and their locations."]
[9.5,"Appropriate contracts are in place with all third parties used to dispose of personal information.","9.5.1","\tEnsure contracts are signed by an appropriate senior manager."]
[{"$f":"A17","v":9.5},"Appropriate contracts are in place with all third parties used to dispose of personal information.","9.5.2","\tEnsure contracts include all required clauses and details, including security measures, accountability, and your right to audit providers."]
[9.6,"Evidence of secure disposal is obtained from third parties used to dispose of personal information.","9.6.1","\tCheck periodically that the security of third-party services is to the agreed standard."]
[{"$f":"A19","v":9.6},"Evidence of secure disposal is obtained from third parties used to dispose of personal information.","9.6.2","\tAssign a staff member to check destruction certificates match what you sent for destruction."]

{"sheet":"10. Right to be forgotten","index":14,"n_rows":7,"n_cols":10,"rows_kept":7,"cut":false,"hidden":false,"merged":[[1,1,6,1],[1,0,6,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[10.1,"Processes for handling requests for erasure of personal information are in place and outlined in policies.","10.1.1","Document how to handle requests in sufficient detail in policies, including who oversees the request process and how."]
[null,null,"10.1.2","Document how to determine if there is a compelling reason to continue processing information, as part of the request."]
[null,null,"10.1.3","Have a process to inform third parties about any request for erasure, if you delete personal information that you have shared with them."]
[null,null,"10.1.4","Give these policies appropriate document and version control."]
[null,null,"10.1.5","\tCommunicate these policies to staff who deal with requests and make policies readily available for them to refer to."]
[null,null,"10.1.6","Keep policies up-to-date, particularly with any changes to data protection law."]