Compliance is an operating system, not a single policy. Organisations need evidence that information is collected for clear purposes, used lawfully, kept accurate, protected, retained appropriately and handled transparently.
What to know
- ✓Map processing and record purpose, lawful basis, data categories, recipients, retention and controls.
- ✓Provide clear notices and workable processes for data-subject rights.
- ✓Use written processor arrangements and check supplier security guarantees.
- ✓Maintain evidence that controls operate in practice, not only on paper.
Governance and accountability
Confirm licence or registration status, appoint and notify a suitably qualified DPO where required, assign accountable owners and secure management commitment. Maintain a policy framework, decision records and an improvement plan.
Purpose, necessity and lawful basis
Before collecting information, define a specific and legitimate purpose. Record why each category is necessary and the lawful ground relied on. Non-sensitive processing may rely on the grounds listed in section 10 of the Act; sensitive processing generally requires written consent unless an exception applies.
Lifecycle and transparency
Give a clear notice at or before collection, keep information accurate, collect no more than needed and retain it only for an appropriate period. Build a retention schedule around purpose and applicable sector laws, then dispose of information securely.
Processors and third parties
A controller must obtain security guarantees and use a written contract or legal instrument with processors. Due diligence should examine access, confidentiality, breach escalation, deletion or return, subcontracting, location and audit evidence.
Demonstrate that it works
Keep a current inventory or record of processing, rights-request log, consent records where relevant, training evidence, incident register, risk assessments, DPIAs, supplier reviews and remediation tracking. Test whether staff and systems follow the documented controls.
Read the underlying material
- Cyber and Data Protection Act: sections 7–18 and 24
- S.I. 155 of 2024: sections 10 and 16
- Implementation Guidelines: Annexure A assessment checklist