Farringford Legal Founder Fundamentals

Regulatory Registrations

Rows	Yes	No	In progress	Don't Know	N/A
ICO registration in place
ICO registration coves all data processing activities
Have you appointed an EU Representative?

Data Protection Office (DPO)

Rows	Yes	No	In progress	Don't Know	N/A
DPO and/or responsible person appointed

Company Server

Rows	Yes	No	In progress	Don't Know	N/A
Secure drive/folder for Finance
Secure drive/folder for HR
Folder permissions/access documented
Folder permissions/access review process in place
Secure transfer system (SFTP) in place (if applicable)

IT Security and Risk

Rows	Yes	No	In progress	Don't Know	N/A
Laptop encryption in place
Do you offer company mobile phones?
Desk top protocol (clear desk policy)
Joiners/movers/leavers policy (JML)
Secure transfer system (SFTP) in place (if applicable)

HR

Rows	Yes	No	In progress	Don't Know	N/A
Do you use an employee HR portal?
Do you use contractors?
Do you have an employee handbook in place?
Do you distribute company policies annually (and confirmation of receipt/read)

Record of Processing Activities (RoPA)

Rows	Yes	No	In progress	Don't Know	N/A
Do you have your RoPA in place?
RoPA maintenance & review process established

Business Continuity Planning (BCP)

Rows	Yes	No	In progress	Don't Know	N/A
BCP in place
BCP cascade tested annually

Company Policies

Rows	Yes	No	In progress	Don't Know	N/A
Privacy policy/notice
Cookie policy
AI Acceptable Use policy
Data Breach policy
Data Privacy Impacy Assessment (DPIA) policy
BYOD/Mobile Device policy
IT & COmmunications policy
Password Management policy
Cyber Incident Response
Privacy policy log in place & maintained

Data Protection Impact Assessment (DPIA)

Rows	Yes	No	In progress	Don't Know	N/A
DPIA templace in place
DPIAs completed for core products/offers
DPIA log in place

Legal Basis for Processing Personal Data

Rows	Yes	No	In progress	Don't Know	N/A
Legitimate Interest Assessment template (LIA)
Legitimate Interested Assessment log
LIAs crafted for core processing relying on legitimate interest

Data Subject Access Requests

Rows	Yes	No	In progress	Don't Know	N/A
Data Subject Access Request (DSAR) log
DSAR form
DSAR response process documented

Website Management and Cookies

Rows	Yes	No	In progress	Don't Know	N/A
You know your webiste host location
Your website cookie banner (pop-up) in place
Terms of Use

Management of Suppliers

Rows	Yes	No	In progress	Don't Know	N/A
Supplier contracts (SLAs/MLAs) in place
Transfer of personal data outside the UK/EEA known and IDTA/SCCs in place
Supplier audit process in place

Data Breach

Rows	Yes	No	In progress	Don't Know	N/A
Data incident/breach log in place
Data incident/breach form in place and communicated to the business

Marketing

Rows	Yes	No	In progress	Don't Know	N/A
You know the client database location/owner
CRM system in place (if applicable)
Consent for marketing recorded

AI Governance

Rows	Yes	No	In progress	Don't Know	N/A
AI 'owner' for the business in place
AI asset list in place
AI RoPA in place
DPIAs for tools/systems in place
AI literacy training planned

Data Protection Training Programme

Rows	Yes	No	In progress	Don't Know	N/A
Annual data protection training for all staff
Data protection training for new joiners
Training materials availbe to the business
Regular 'phishing' tests (quarterly)

Insurance

Data Protection Complaints

Rows	Yes	No	In progress	Don't Know	N/A
A documented process for responding to data protection complaints
An email address, postal address or portal/platform for receiving complaints
Complaints acknowledgement wording
A complaints audit log
Training: responding to a data protection complaint

Other

Rows	Yes	No	In progress	Don't Know	N/A
Modern slavery statement
Modern slavery process established for suppliers
Anti-bribery policy

Any other information