TS-RDC-06
Trust & Stewardship
Risk, Data & Compliance
CORE
Compliance
v2.9.7
GDPR accountability & DPIA log
Assesses a systematic approach to GDPR compliance, ensuring all new or changed data processing activities are screened for risk, full Data Protection Impact Assessments (DPIAs) are conducted where required, and a formal log is maintained to demonstrate accountability. This rigorous oversight embodies the Islamic principle of muhasabah (accountability) and the imperative of sadd al-dhara'i (blocking the means to harm) by proactively identifying and mitigating risks to safeguard privacy.
Assessment Questions
- Is a DPIA screening checklist completed for every new/changed processing activity, and are 'no DPIA required' decisions recorded with rationale?
- Does the organization have a documented policy and procedure for conducting DPIAs that includes consultation and Art. 36 triggers?
- Is there a formal, centrally managed log to record all screenings/DPIAs, their outcomes, residual risks, and links to the ROPA?
- Where residual high risk remains, is there documented Art. 36 escalation (senior sign-off and/or ICO consultation)?
- Do DPIAs explicitly assess processors, data sharing, and international transfers, and do outcomes feed contract/DPA requirements?
- How are the collective findings from DPIAs used to identify trends and drive continuous improvement?
Evidence Requirements
- The official DPIA policy, procedure, and assessment template.
- DPIA screening checklist samples (including 'no DPIA required' cases).
- The complete DPIA log/register, showing history, residual risks, and status.
- Examples of completed DPIA reports for high-risk activities.
- Evidence of DPIA integration in project documentation (stage-gate checklists).
- Example of ROPA (Art. 30) or Risk Register updates triggered by DPIA findings.
- Board/SMT paper summarising DPIA log and top privacy risks.
Scoring Guidelines
| Level | Rating | Description |
|---|---|---|
| 5 | 5/5 | Continuous improvement via thematic reviews, quality metrics, and external assurance; DPIA insights proactively inform strategy |
| 4 | 4/5 | DPIA screening mandatory at project initiation; stage-gates enforce 'no-go' without sign-off; residual risks accepted by senior owners |
| 3 | 3/5 | A documented process and template exist; central log is maintained but application may be inconsistent |
| 2 | 2/5 | Minimal process; DPIAs are conducted ad-hoc for some high-risk projects; no formal screening or central log |
| 1 | 1/5 | No DPIA process, screening, or log. |
Related Criteria
Version
2.9.7
2025-11-05
Discussion (1)
Administrator
2026-03-07 11:07:51.693135
📋 **Version updated: 1.0.0 → 2.9.7** **Changes:** Updated islamic_references from mizan-297.json
Sign in to post a comment.