Scribd
Upload
525 views8 pages

Data Protection Audit Checklist

This document contains a 34 question audit checklist for assessing an organization's data protection and privacy practices. It covers topics such as risk assessments, user access management, roles and responsibilities, information handling policies, breach protocols, employee training, system access management, audit logging, statutory and regulatory compliance, individual access and consent, security measures, email security, capacity building, and organizational policies for handling personal data. The checklist is used to evaluate departments and provide remarks on audit evidence and status.

Uploaded by

violet osadiaye
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
525 views8 pages

Data Protection Audit Checklist

This document contains a 34 question audit checklist for assessing an organization's data protection and privacy practices. It covers topics such as risk assessments, user access management, roles and responsibilities, information handling policies, breach protocols, employee training, system access management, audit logging, statutory and regulatory compliance, individual access and consent, security measures, email security, capacity building, and organizational policies for handling personal data. The checklist is used to evaluate departments and provide remarks on audit evidence and status.

Uploaded by

violet osadiaye
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
  • Data Protection and Privacy Audit Checklist

DATA PROTECTION AND PRIVACY AUDIT CHECKLIST

S/N QUESTIONS DEPARTMENT AUDIT STATUS SCMU REMARKS


/AUDITEE EVIDENCE
1 Has a Risk Assessment
been facilitated for the
information asset?

2 Are regular user account


access and privilege
access rights authorized
and recorded?

3 Has the roles and


responsibilities for asset
owners and custodians
been documented and
communicated?

4 Has an information
handling practice and
standard been
documented for the
collection, transmission,
storage and disposal of
personal information?

5 Has a breach protocol


been documented and
communicated to all
stake holders?

6 Have Organizational
employees been trained
on the requirements for
protecting personal
information?

7 Has a process been


documented for granting
users access to the
maintenance application
to add, change or delete
personal information?

8 Does the business system


including audit logging of
access to personal
information including
date and time stamping
and user account?
9 Has training and
awareness been
developed for
Organizational
employees?

10 Does the training include


an overview of statutory,
regulator and
contractual obligations
for data protections?

11 Does training include an


overview of
Organizational policies,
practices and standards
relating to the Handling
of personal information?

12 Does training include


instructions concerning
the reporting of
suspected breaches in
security?

13 Does training include


instructions regarding
the “whistleblower”
policy?

14 Are there documented


plans for training on
“how to” facilitate a
privacy impact
assessment?

15 Are new hires required to


attend information
handling training and
awareness before access
to personal information
is granted?

16 Have all Organizational


employees accessing
personal information
attended training and
awareness?

17 Has an annual training


and awareness program
and schedule been
created and
communicated?

18 What kind of personally


identifiable information
does the organization
collect on employees of
the organization and
members of the public

19 Any purpose for which


the personally
identifiable information
is collected

20 Any notice given to


individuals regarding the
collection and use of
personal information
relating to that
individual

21 Any access given to


individuals to review,
amend, correct,
supplement, or delete
personal information
relating to that
individual

22 Whether or not consent


is obtained from an
individual before
personally identifiable
information is collected,
used, transferred, or
disclosed and any
method used to obtain
consent

23 The policies and


practices of the
organization for the
security of personally
identifiable information

24 The policies and


practices of the
organization for the
proper use of personally
identifiable information
25 Organization policies and
procedures for privacy
and data protection

26 The policies and


procedures of the
organization for
monitoring and reporting
violations of privacy and
data protection policies
27 The policies and
procedures of the
organization for assessing
the impact of
technologies on the
stated privacy and
security policies

28 What security measures


do you have in place for
data protection?

29 How do you protect your


system from hackers?

30 Do you have set up


firewalls?

31 How do you ensure that


stored data can only be
accessed by specific
authorized individuals?

32 What protection do you


have in place for
emailing systems?

33 Continuous capacity
building for staff

34 Do you have developed


organizational policies
for handling personal
data?

DATA PROTECTION AND PRIVACY AUDIT CHECKLIST S/N QUESTIONS DEPARTMENT /AUDITEE AUDIT EVIDENCE STATUS SCMU REMARKS 1 Has a Ris
handling practice and standard been documented for the collection, transmission, storage and disposal of personal inform
access to personal information including date and time stamping and user account? 9 Has training and awareness been deve
suspected breaches in security? 13 Does training include instructions regarding the “whistleblower” policy? 14 Are th
is granted? 16 Have all Organizational employees accessing personal information attended training and awareness? 17 Has
collection and use of personal information relating to that individual 21 Any access given to individuals to review, ame
organization for the proper use of personally identifiable information 25 Organization policies and procedures for privacy
firewalls? 31 How do you ensure that stored data can only be accessed by specific authorized individuals? 32 What protecti

You might also like