Infosys - GDPR Readiness Assessment

Quick Analysis Tool GDPR Readiness Assessment

This tool provides a quick analysis of where organization stands w.r.t. GDPR compliance based on the responses provided to 20 questions.

You can get the assessment results instantly!

With the GDPR deadline approaching closer, emphasis is given on reducing the monetary risk by providing weightage to GDPR focus areas as per the penalties associated in case of non-compliance. A higher weightage is assigned to GDPR area leading to higher penalties and lower weightage to GDPR area leading to lower penalties.

Fill the details below to take the Assessment

Quick Analysis Tool

Scope
DPO
Privacy by Design
Erasure/Rectification of Data
Data Portability
DPIA
Notification of Breach
Territorial Scope
Consent & Profiling

Scope

Question 1 of 20

Are you Directive 95 compliant, which will be repealed by GDPR from 25th May 2018?

Yes Partially No

Scope

Question 2 of 20

Is your organization compliant with country level data privacy laws which overlap with the GDPR key asks like Dutch Privacy Law?

Yes Partially No

Scope

Question 3 of 20

Is your organization compliant with industry data privacy laws which overlap with the GDPR key asks like PCI-DSS (Payment Card Industry - Data Security Standard)?

Yes Partially No

DPO

Question 4 of 20

Do you have a Data Protection Officer (DPO) who exercises the roles and responsibilities as directed in GDPR at an organization level?

Yes Partially No

Privacy by Design

Question 5 of 20

Do you ensure data protection by design across applications?

Yes Partially No

Privacy by Design

Question 6 of 20

Does your organization use pseudonymised or encrypted data from which living individuals can be re-identified as per GDPR requirements?

Yes Partially No

Privacy by Design

Question 7 of 20

Have you assessed the need to capture/store/process/consume personal data (transactional/master)?

Yes Partially No

Privacy by Design

Question 8 of 20

Are there processes to ensure the quality of EU Residents's personal data (i.e. accurate, consistent and updated) is maintained across the entire data lifecycle and transactional/archival systems?

Yes Partially No

Privacy by Design

Question 9 of 20

Do you have any tools to manage the personal data lineage of EU residents?

Yes Partially No

Erasure/Rectification of Data

Question 10 of 20

Is there a system in place where the data subject could view his/her personal data and exercise his/her GDPR rights (like Right to be forgotten, Right to Rectification) with the organization?

Yes Partially No

Erasure/Rectification of Data

Question 11 of 20

Does your system allow automated updating of personal data based on the request from data subject?

Yes Partially No

Data Portability

Question 12 of 20

Can the personal data be provided in a structured and commonly used machine-readable format easily whenever requested?

Yes Partially No

Data Portability

Question 13 of 20

Have you established policies and procedures for data transfer requests from data subjects and competitors?

Yes Partially No

DPIA

Question 14 of 20

Do you carry out DPIA (Data Protection Impact Assessment) at regular intervals as directed by GDPR?

Yes Partially No

DPIA

Question 15 of 20

Do you have the required mechanism to Report DPIA analysis and results to regulators (where required) and external stakeholders (if appropriate)

Yes Partially No

Notification of Breach

Question 16 of 20

Is there an automated process in place to trigger a notification whenever a breach happens to the personal data at an organization level within 72 hours?

Yes Partially No

Notification of Breach

Question 17 of 20

Is there a communication system in place to generate notifications in case of breach/alerts (to affected individuals) and reports (to regulators, credit agencies, law enforcement) protocol

Yes Partially No

Territorial Scope

Question 18 of 20

Has your organization assessed the extent to which GDPR will impact including all services to the EU Residents?

Yes Partially No

Consent & Profiling

Question 19 of 20

Do you record the consent from the data subject in an explicit, freely given, unambiguous, specific and formed format wherever required?

Yes Partially No

Consent & Profiling

Question 20 of 20

Do you capture consent for the profiling activities as directed by GDPR?

Yes Partially No

Thank you for taking the assessment. We shall connect with you soon to schedule a workshop and make further recommendations

Degree of GDPR Compliance

Focus Area	Where you are? (As-Is state)	Where you should be? (To-Be state)
a - Scope		3.00
b - DPO		24.00
c - Privacy by Design		9.00
d - Erasure / Rectification of Data		15.00
e - Data Portability		12.00
f - DPIA		6.00
g - Notification of Breach		21.00
h - Territorial Scope		6.00
i - Consent & Profiling		18.00