Scope
- Personal-data inventory and processing purposes
- Privacy notices, consent forms and policy documents
- Technical measures: access control, encryption, logging
- Registry filing and update process
- Breach response plan and notification procedure
- Staff awareness training