Data Protection Questionnaire | Cardo Connexion Technologies

Section 1

Organisation & Governance

1. Organisation Name *

2. Industry / Sector *

3. Primary Location(s) of Operations

4. Approximate Number of Employees

5. Does the organisation qualify as a Data Controller, Data Processor, or both?

Data Controller = collects or holds the data. Data Processor = third-party engaged by the controller to process data.

Data Controller Data Processor Both Unsure

6. Has the organisation registered as a Data Controller?

Yes No Unsure

Section 2

Data Protection Governance & Accountability

7. Has a Data Protection Officer (DPO) or equivalent role been appointed?

Yes (Internal) Yes (External / Outsourced) No

8. If no DPO is appointed, who currently oversees data protection matters?

9. Does senior management receive updates or reports on data protection risks?

Yes No

Section 3

Personal Data Processing Activities

10. What types of personal data does the organisation process? (tick all that apply)

Employee data Customer data Supplier / contractor data Marketing data Financial / payment data CCTV / biometric data

11. Does the organisation process special categories of personal data?

Health data Biometric data Criminal / disciplinary records None Unsure

12. Are data processing activities formally documented?

Yes (e.g. RoPA / data inventory) Partially No

Section 4

Lawful Basis & Purpose Limitation (CDPA Core Requirement)

13. Does the organisation clearly define the lawful basis for processing personal data?

Yes Partially No

14. How is consent obtained where required?

Written contracts / forms Digital / online Implied Not applicable Unsure

15. Are data subjects informed about the following?

Purpose of processing?

Yes No

Data retention period?

Yes No

Their rights under CDPA?

Yes No

Section 5

Policies, Procedures & Awareness

16. Which of the following policies are in place?

Data Protection / Privacy Policy Data Retention & Disposal Policy Information Security Policy Breach Notification Procedure None of the above

17. Have employees received data protection awareness training?

Yes (formal & documented) Informal / ad-hoc No

18. Are high-risk departments (HR, Finance, Customer-facing) given tailored guidance?

Yes No

Section 6

Data Subject Rights (DSR)

19. Is there a defined process to handle the following?

Data access requests?

Yes No

Data correction requests?

Yes No

Data deletion / erasure requests?

Yes No

20. Are staff aware of how to escalate data subject requests?

Yes No

Section 7

Data Security & Safeguards

21. How is personal data stored?

On-premises Cloud Third-party systems Combination of the above

22. Are appropriate technical and organisational measures in place?

Access controls Password policies Encryption Logging & monitoring Regular backups

23. Are third-party vendors assessed for data protection risks?

Yes Partially No

Section 8

Data Breach & Incident Management

24. Is there a documented data breach response procedure?

Yes No

25. Are staff trained to recognise and report data breaches?

Yes No

26. Has the organisation experienced a data breach in the past 24 months?

Yes No Unsure

Section 9

Data Retention & Destruction

27. Are data retention periods defined and documented?

Yes Partially No

28. Is data securely disposed of when no longer required?

Yes No Unsure

Section 10

Compliance Confidence & Priorities

29. How would you rate your organisation's overall CDPA compliance maturity?

Low (High risk exposure) Medium (Partial compliance) High (Well controlled)

30. What are your top data protection concerns today?

31. Any upcoming audits, regulatory reviews, or board directives relating to data protection?

Data Protection Services Questionnaire

Your Contact Details

Organisation & Governance

Data Protection Governance & Accountability

Personal Data Processing Activities

Lawful Basis & Purpose Limitation (CDPA Core Requirement)

Policies, Procedures & Awareness

Data Subject Rights (DSR)

Data Security & Safeguards

Data Breach & Incident Management

Data Retention & Destruction

Compliance Confidence & Priorities

Prefer to talk first?