Farringford Legal Founder Fundamentals

Regulatory Registrations*

Rows	Yes	No	In progress	Don't Know	N/A
ICO registration in place
ICO registration coves all data processing activities
Have you appointed an EU Representative?

Data Protection Office (DPO)*

Rows	Yes	No	In progress	Don't Know	N/A
DPO and/or responsible person appointed

Company Server*

Rows	Yes	No	In progress	Don't Know	N/A
Secure drive/folder for Finance
Secure drive/folder for HR
Folder permissions/access documented
Folder permissions/access review process in place
Secure transfer system (SFTP) in place (if applicable)

IT Security and Risk*

Rows	Yes	No	In progress	Don't Know	N/A
Laptop encryption in place
Do you offer company mobile phones?
Desk top protocol (clear desk policy)
Joiners/movers/leavers policy (JML)
Secure transfer system (SFTP) in place (if applicable)

HR*

Rows	Yes	No	In progress	Don't Know	N/A
Do you use an employee HR portal?
Do you use contractors?
Do you have an employee handbook in place?
Do you distribute company policies annually (and confirmation of receipt/read)

Record of Processing Activities (RoPA)*

Rows	Yes	No	In progress	Don't Know	N/A
Do you have your RoPA in place?
RoPA maintenance & review process established

Business Continuity Planning (BCP)*

Company Policies*

Rows	Yes	No	In progress	Don't Know	N/A
Privacy policy/notice
Cookie policy
AI Acceptable Use policy
Data Breach policy
Data Privacy Impacy Assessment (DPIA) policy
BYOD/Mobile Device policy
IT & COmmunications policy
Password Management policy
Cyber Incident Response
Privacy policy log in place & maintained

Data Protection Impact Assessment (DPIA)*

Rows	Yes	No	In progress	Don't Know	N/A
DPIA templace in place
DPIAs completed for core products/offers
DPIA log in place

Legal Basis for Processing Personal Data*

Rows	Yes	No	In progress	Don't Know	N/A
Legitimate Interest Assessment template (LIA)
Legitimate Interested Assessment log
LIAs crafted for core processing relying on legitimate interest

Data Subject Access Requests*

Rows	Yes	No	In progress	Don't Know	N/A
Data Subject Access Request (DSAR) log
DSAR form
DSAR response process documented

Website Management and Cookies*

Rows	Yes	No	In progress	Don't Know	N/A
You know your webiste host location
Your website cookie banner (pop-up) in place
Terms of Use

Management of Suppliers*

Rows	Yes	No	In progress	Don't Know	N/A
Supplier contracts (SLAs/MLAs) in place
Transfer of personal data outside the UK/EEA known and IDTA/SCCs in place
Supplier audit process in place

Data Breach*

Rows	Yes	No	In progress	Don't Know	N/A
Data incident/breach log in place
Data incident/breach form in place and communicated to the business

Marketing*

Rows	Yes	No	In progress	Don't Know	N/A
You know the client database location/owner
CRM system in place (if applicable)
Consent for marketing recorded

AI Governance*

Rows	Yes	No	In progress	Don't Know	N/A
AI 'owner' for the business in place
AI asset list in place
AI RoPA in place
DPIAs for tools/systems in place
AI literacy training planned

Data Protection Training Programme*

Rows	Yes	No	In progress	Don't Know	N/A
Annual data protection training for all staff
Data protection training for new joiners
Training materials availbe to the business
Regular 'phishing' tests (quarterly)

Insurance*

Data Protection Complaints*

Rows	Yes	No	In progress	Don't Know	N/A
A documented process for responding to data protection complaints
An email address, postal address or portal/platform for receiving complaints
Complaints acknowledgement wording
A complaints audit log
Training: responding to a data protection complaint

Other*

Rows	Yes	No	In progress	Don't Know	N/A
Modern slavery statement
Modern slavery process established for suppliers
Anti-bribery policy

Any other information