# NDPA Compliance Assessment Template

## 1. Organisation Information

| Field | Value |
|-------|-------|
| Organisation name | |
| Industry sector | |
| Number of data subjects | |
| NDPC registration number | |
| DPO appointed | Yes / No |
| DPCO engaged | Yes / No |

## 2. Registration and DPCO Status

- [ ] Organisation registered with the NDPC
- [ ] Registration details current and accurate
- [ ] DPCO engaged (if >2,000 data subjects)
- [ ] Annual DPCO audit completed
- [ ] Audit report filed with NDPC
- Last audit date: _______________

## 3. Processing Activity Register

| Activity ID | Description | Lawful Basis | Data Categories | Sensitive Data | Cross-Border |
|---|---|---|---|---|---|
| | | Consent / Contract / Legal obligation / Vital interests / Public interest / Legitimate interests | | Yes / No | Yes / No |
| | | | | | |

## 4. Lawful Basis Verification

| Activity | Lawful Basis | Consent Documented | LIA Conducted | Derogation Applied |
|----------|-------------|-------------------|---------------|-------------------|
| | | Yes / No / N/A | Yes / No / N/A | Yes / No / N/A |
| | | | | |

## 5. Sensitive Data Processing

| Category | Processed | Explicit Consent | Derogation |
|----------|-----------|-----------------|------------|
| Racial/ethnic origin | Yes / No | Yes / No / N/A | |
| Political opinions | Yes / No | Yes / No / N/A | |
| Religious/philosophical beliefs | Yes / No | Yes / No / N/A | |
| Trade union membership | Yes / No | Yes / No / N/A | |
| Genetic data | Yes / No | Yes / No / N/A | |
| Biometric data | Yes / No | Yes / No / N/A | |
| Health data | Yes / No | Yes / No / N/A | |
| Sex life/sexual orientation | Yes / No | Yes / No / N/A | |
| Criminal convictions | Yes / No | Yes / No / N/A | |

## 6. Cross-Border Transfers

| Destination | Safeguard | TIA Conducted | Documentation |
|-------------|-----------|---------------|---------------|
| | Adequacy / SCCs / BCRs / Derogation | Yes / No | Yes / No |
| | | | |

## 7. Data Subject Rights Handling

| Right | Mechanism | Response SLA (30 days) | Documented |
|-------|-----------|----------------------|------------|
| Right to be informed | | Yes / No | Yes / No |
| Right of access | | Yes / No | Yes / No |
| Right to rectification | | Yes / No | Yes / No |
| Right to erasure | | Yes / No | Yes / No |
| Right to restrict processing | | Yes / No | Yes / No |
| Right to data portability | | Yes / No | Yes / No |
| Right to object | | Yes / No | Yes / No |
| Automated decision-making | | Yes / No | Yes / No |

## 8. Breach Management

- [ ] Breach response plan documented
- [ ] 72-hour NDPC notification process in place
- [ ] Data subject notification process in place
- [ ] Breach register maintained
- Breaches in past 12 months: _______________

## 9. DPIA Status

| Processing Activity | DPIA Required | DPIA Conducted | Filed with NDPC | Date |
|---|---|---|---|---|
| | Yes / No | Yes / No | Yes / No | |
| | | | | |

## 10. Compliance Risk Summary

| Area | Status | Risk Level | Action Required |
|------|--------|------------|----------------|
| NDPC registration | | | |
| DPCO engagement | | | |
| Lawful basis | | | |
| Cross-border transfers | | | |
| Data subject rights | | | |
| Breach management | | | |
| DPIA obligations | | | |

## 11. Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| DPO | | | |
| Legal Counsel | | | |
| CISO | | | |