Simple GDPR Compliant Asset Disposal

Name*

Company or Organisation*

Phone Number*

Email*

1. Does your organisation have a plan in place to conduct a DPIA (Data Protection Impact Assessment)?*

Yes
No

2. Have you created a data disposal and retention policy?*

Yes
No

3. Do you have an up to date / documented Breach Notification process?*

Yes
No

4. Do you have an up to date / documented Data Subject Rights Request process?*

Yes
No

5. Have you reviewed the data destruction requirements of your organisation?*

Yes
No

6. Do you have a GDPR compliant service agreement in place with your selected asset disposer?*

Yes
No

7. Have you considered the appointment of a Data Protection Officer (if applicable)?*

Yes
No

8. Do you have a Data Protection Policy that is regularly reviewed?*

Yes
No

9. Have you made sure that all relevant staff members are aware of the security processes that must be followed when disposing of data bearing IT assets?*

Yes
No

10. Have you selected an appropriate Data Processor to dispose of your data? You must select one that can:*

Provide sufficient guarantees, in terms of expert knowledge and ability, to deliver the service (including appropriate technical and organisational measures).
Adhere to an approved code of conduct.
Adhere to an approved certification mechanism.
Regularly test, assess and evaluate the effectiveness of their measures, ensuring the security of processing.
Are dedicated to notifying the controller without undue delay after becoming aware of a personal data breach.

Yes
No

11. Do you have a signed agreement in place with your data processor? It must contain the following as a minimum:*

Confirmation of agreed auditing detail
Confirmation of approved sanitisation process
Confirmation that the your organisation is the owner of the redundant assets and are legally entitled to release the equipment
Confirmation of the point of the process in which transfer of custody for redundant items occurs
Details the limit of liability
Designation of your service provider as the Data Processor

Yes
No

Asset Disposal Made Simple

GDPR Questionnaire