Evaluate privacy governance, lawful processing, data subject rights, processor controls, security, transfers, retention, and breach readiness.

Is a record of processing activities maintained for personal data handled by the organization?

The record should capture purposes, categories, recipients, transfers, retention, and security measures.