GDPR compliance questionnaire

Discover if your company complies with the GDPR

Since May 25th, 2018, companies cannot collect personal data like they used to. Now they are subjected to a weighty European regulation: the GDPR (General Regulation on Personal Data). Some common preconceptions lead to believe that the GDPR does not apply to everyone or that it’s only a formality. But reality is quite different! This regulation is mandatory for every company and requires important internal changes. If you don’t apply this regulation, you’re likely to get a penalty of either 4% of your annual turnover or of €20 million! Consequently, you should spare no expenses to be compliant.

You want to know all the steps to properly apply the GDPR? Answer this questionnaire, then we’ll tell you exactly what you need to do to comply with this regulation. If it turns out that you’re not totally compliant, Ziwit teams can provide their expertise to help you get back on the right track! Even if you think that you’re GDPR compliant, answer this questionnaire anyway. You may be surprised by the result…

Start the questionnaire

Discover if your company complies with the GDPR

Generalities
Processing of personal data
Data transfer
Internal implementation
Data security

Question 1 : Does your company have at least:

An employee?

A client/customer?

A public service user ?

A prospect?

A contractor?

None of the above

All fields are mandatory

Question 2 : Where is located your company?

On the EEA territory

Outside the EEA territory

All fields are mandatory

Question 3 : Is your activity related to offering goods or services to the Member States of the EEA?

Yes

No

All fields are mandatory

Question 4 : Do you monitor people’s behavior within the EEA?

Yes

No

All fields are mandatory

Question 5 : Do you possess at least one data that can be used to identify someone?

Yes

No

All fields are mandatory

Question 6 : Do you possess personal data of a child below the age of 16 years?

Yes

No

All fields are mandatory

Question 7 : Did you get the legal guardians’ consent to collect data relating to their child?

Yes

No

All fields are mandatory

Question 8 : Do you collect the following sensitive data?

Racial or ethnic origin

Political opinions

Religious or philosophical beliefs

Trade union membership

Genetic data

Biometric data

Health data

Data concerning a person’s sex life or sexual orientation

None of the above

All fields are mandatory

Question 10 : Does your processing fulfill at least one of the following criteria?

Processing is necessary for the performance of a contract

Processing is necessary for compliance with a legal obligation

Processing is necessary in order to protect the vital interests of the person

Processing is necessary for the performance of a public interest mission

Processing is necessary for the purposes of the legitimate interests pursued by the controller

None of the above

All fields are mandatory

Question 11 : Before collecting the persons’ data, did you ask for their consent?

Yes

No

All fields are mandatory

Question 12 : Under what conditions was the consent given?

Consent was asked regardless of any other question

Consent was never asked

Consent was contained within (an)other question(s)

All fields are mandatory

Question 14 : Do you inform the person about the purposes of the processing?

Yes

No

All fields are mandatory

Question 15 : Is the processing the same as the announced?

Yes

No

All fields are mandatory

Question 16 : Is the personal data processing likely to result in a high risk to the persons’ rights and freedoms?

Yes

No

All fields are mandatory

Question 17 : Did you carry out an impact assessment about the existence of that high risk (PIA)?

Yes

No

All fields are mandatory

Question 19 : Did you carry out an impact assessment (PIA)?

Yes

No

All fields are mandatory

Question 20 : Does your website or application comply with:

Data protection by design

Data protection by default

None

All fields are mandatory

Question 21 : Does your company have a branch or subsidiary:

On the EEA territory

Outside the EEA territory

My company does not have any branch or subsidiary

All fields are mandatory

Question 22 : Did you impose binding corporate rules (BCR) to your branch or subsidiary?

Yes

No

All fields are mandatory

Question 23 : Do you control on a regular basis the way your branch or subsidiary processes data?

Yes

No

All fields are mandatory

Question 24 : Does a third-party process data on behalf of your company (delegation to a contractor, partnership, etc…)?

Yes

No

All fields are mandatory

Question 25 : Where are located the third parties that process data on your behalf?

On the EEA territory

Outside the territory of the EEA

Both

All fields are mandatory

Question 26 : Do you have a processor in one of the following countries (multiple replies are possible)?

Argentina

Canada

Etats-Unis

Israel

Japan

New Zealand

Suisse

Uruguay

Other country(ies)

All fields are mandatory

Question 27 : Did you establish appropriate safeguards with this other country?

Yes

No

All fields are mandatory

Question 28 : Does your controller control the data processed by the processor on a regular basis?

Yes

No

All fields are mandatory

Question 29 : How many employees are there in your company?

Over 250 employees

Less than 250 employees

All fields are mandatory

Question 30 : Does the data processed within your company fall into one of the following categories?

Processing is likely to result in a high risk for the rights and freedoms of the data subject

Processing is frequent

Processing contains sensitive data

Processing contains data relating to criminal convictions or offenses

None of the above

All fields are mandatory

Question 31 : Do you maintain a record of processing activities?

Yes

No

All fields are mandatory

Question 32 : Do your processing operations require regular and systematic monitoring of persons on a large scale?

Yes

No

All fields are mandatory

Question 33 : Do you process sensitive data on a large scale?

Yes

No

All fields are mandatory

Question 34 : Did you designate a DPO?

Yes

No

All fields are mandatory

Question 35 : Did the DPO map all the data held by the company?

Yes

No

All fields are mandatory

Question 36 : Did the DPO take technical and organizational measures to process the data?

Yes

No

All fields are mandatory

Question 37 : Did you update your General Terms and Conditions of your website or your Privacy Policy, in compliance with the obligations imposed by the GDPR?

Yes

No

All fields are mandatory

Question 38 : Did you anonymize or pseudonymize the data?

Yes

No

All fields are mandatory

Question 39 : Is the data protected enough by strong solutions?

Yes

No

All fields are mandatory

Question 40 : Who can access the data?

Any person from the company

Only the persons from the company authorized to process the data

None of the above

All fields are mandatory

Question 41 : Are all your digital devices protected?

Yes

No

All fields are mandatory

Question 42 : Did you implement solutions to prevent data theft (software, technical and organizational measures, etc…)

Yes

No

All fields are mandatory

Question 43 : Do you have proof of all the steps you followed to apply the GDPR?

Yes

No

All fields are mandatory

Question 44 : Did your employees undergo a training on the GDPR and good IT practices?

Yes

No

All fields are mandatory

You are in total compliance with the GDPR

Know more about our solutions

You are not subjected to the GDPR

Know more about our solutions

You are not keeping with the GDPR

Get your results

We only use technical cookies related to the operation of the site and audience measurement (anonymous statistical data). OK