The inventory aims to understand which data is processed in the company and what measures have already been taken. The inventory is the basis for identifying the necessary measures.
Personal Data
- Where and how is personal data collected and for what purpose?
- What personal data is processed and for what purpose?
- Are particularly sensitive data processed?
- Is profiling or high-risk profiling conducted?
- How are the data processed and by what means?
Data security
- Where are the data stored (paper) or stored (digital)?
- Who has access to the data or can access the data?
- How are the data already protected (physically, digitally)?
Data Disclosure
- Are data disclosed to third parties? To whom?
- Are data disclosed to data processors?
- Are data disclosed to contractual partners?
- Are data transmitted only within the country or also abroad (secure and insecure countries)?
Documents and Contracts
- Is there already a privacy policy for your website?
- Is there already a privacy policy for customer relationships and employees?
- Are there already contracts with data processors?
- Are there already clauses on data protection in contracts with contractual partners, customers, etc.?
Rights of Data Subjects
- How are data subjects informed about data collection and processing?
- How are requests for information from data subjects handled?
- How are requests from data subjects for the release of their data handled?
Information Technology and Telephony (ICT)
- Which IT applications are used? In which applications are personal data processed?
- How is communication conducted (telephony, email, video calls, etc.)? How is personal data processed in these communications?
- How is the ICT organized?
- Are cloud services used? Which ones? Are data transmitted to the USA? Or can companies in the USA access the data?
- Do you engage in online marketing? If yes, through which platforms? Are personal data transmitted to or collected by these platforms?
