Evaluating sources and types of sensitive data, purpose, and legal basis - from data collection, storage, access, retention, to deletion. Enabling Data Protection Impact Assessments (DPIAs) for new data processing systems, processes, and technologies.
Inventory all tracking technologies (including but not limited to cookies), documenting purpose and settings; evaluate mechanisms for user consent (such as consent banner).
Identify international transfers (within or across organizational boundaries), data transfer agreements and applicable regulations.
Validate mechanisms to obtain user consent before collecting and processing personal data; verify opt-out mechanisms, data rectification, access, and deletion requests.
Identify relevant regulations - based on data subjects, role(s) in the data processing ecosystem, locations, and industry - and processes in place to ensure adherence.
Evaluate organizational readiness to respond effectively in the event of a data breach - from identification through containment, and notification - across people, process, and technologies.