DPO Checklist: Managing Data Protection with PETs

---

The checklist and role of A Data Protection Officer are as follows:

Governance & Leadership

• Appointed as DPO under Act A1727, Section 12A

• Data Protection Policy includes PET strategy and compliance principles

• Data Protection Committee formed with cross-departmental reps

• Regular reporting to EXCO/Board on data protection matters

---

Data Inventory & Risk Assessment

• Complete and updated data inventory (what, where, who, why)

• Data flows documented (internal and external transfers)

• Privacy Impact Assessments (PIAs) conducted for all high-risk projects

• Risk register maintained and reviewed quarterly

---

PETs Deployment & Oversight

• File-level encryption deployed (e.g., VeraCrypt, BitLocker)

• Access control systems in place (e.g., OpenLDAP, RBAC)

• Data anonymization or pseudonymization tools implemented (e.g., ARX)

• Masking used in non-production environments

• Secure file sharing enforced (e.g., CryptPad, Nextcloud with E2E encryption)

• Audit logging enabled and reviewed (e.g., Graylog, ELK Stack)

---

Training & Awareness

• Annual privacy training completed by all staff

• PET technical training delivered to IT administrators

• Phishing simulations and BYOD security briefings conducted

• Disciplinary and retraining policy for negligent incidents enforced

---

Incident & Breach Management

• Data breach SOP in place, aligned with Section 12B

• Notification procedures for Commissioner and affected subjects defined

• Breach log maintained with impact assessments and follow-up actions

• Incident response team identified and trained

---

Monitoring & Continuous Improvement

• Monthly audit of PET usage and effectiveness

• Regular review of vendor compliance with data protection obligations

• Policies updated annually or post-incident

• New PETs evaluated as technology or threat landscape evolves