Communicating Effectively With Policyholders

Does the ISP provide a privacy notice to the policyholder?
Ans: {field:1_does_the_isp_provide_a_privacy_notice_to_the_policyholder_1675324827249}
Is the privacy notice drafted in the preferred language of the policyholder?
Ans: {field:2_is_the_privacy_notice_drafted_in_the_preferred_language_of_the_policyholder_1675324880501}
Is the privacy notice written concisely?
Ans: {field:3_is_the_privacy_notice_written_concisely_1675324900982}
Is there an aural privacy notice available for those unable to read?
Ans: {field:4_is_there_an_aural_privacy_notice_available_for_those_unable_to_read_1675325168016}
Is the privacy notice written in simple, plain and easily understandable language?
Ans: {field:5_is_the_privacy_notice_written_in_simple_plain_and_easily_understandable_language_1675325183851}
Is the privacy notice presented just before data collection?
Ans: {field:6_is_the_privacy_notice_presented_just_before_data_collection_1675325234983}
Does the privacy notice prominently disclose the purposes for processing personal data?
Ans: {field:7_does_the_privacy_notice_prominently_disclose_the_purposes_for_processing_personal_data_1675325246717}
Is the purpose communicated in the privacy notice, clear, specific and lawful?
Ans: {field:8_is_the_purpose_communicated_in_the_privacy_notice_clear_specific_and_lawful_1675325258661}
Are the provisions that request consent from policyholders placed distinctly from the other provisions in the notice?
Ans: {field:9_are_the_provisions_that_request_consent_from_policyholders_placed_distinctly_from_the_other_provisions_in_the_notice_1675325276560}
Does the privacy notice disclose the types of personal data that will be collected directly from the policyholder?
Ans: {field:10_does_the_privacy_notice_disclose_the_types_of_personal_data_that_will_be_collected_directly_from_the_policyholder_1675325313217}
Does the privacy notice disclose the types of personal data that will be collected indirectly from third parties?
Ans: {field:11_does_the_privacy_notice_disclose_the_types_of_personal_data_that_will_be_collected_indirectly_from_third_parties_1675325330818}
Does the privacy notice disclose the types of data that are mandatory for a processing activity?
Ans: {field:12_does_the_privacy_notice_disclose_the_types_of_data_that_are_mandatory_for_a_processing_activity_1675325366979}
Does the privacy notice distinctly disclose the types of data that are optional for a processing activity?
Ans: {field:13_does_the_privacy_notice_distinctly_disclose_the_types_of_data_that_are_optional_for_a_processing_activity_1675325420018}
Does the privacy notice disclose the implications for policyholders if they do not provide personal data?
Ans: {field:14_does_the_privacy_notice_disclose_the_implications_for_policyholders_if_they_do_not_provide_personal_data_1675325453931}
Does the privacy notice disclose the procedure policyholders can follow to withdraw consent?
Ans: {field:15_does_the_privacy_notice_disclose_the_procedure_policyholders_can_follow_to_withdraw_consent_1675325480231}
Does the privacy notice disclose the duration for which personal data will be retained?
Ans: {field:16_does_the_privacy_notice_disclose_the_duration_for_which_personal_data_will_be_retained_1675325497897}
Does the privacy notice disclose the details of all the personnel and third parties who will be able to access the data?
Ans: {field:17_does_the_privacy_notice_disclose_the_details_of_all_the_personnel_and_third_parties_who_will_be_able_to_access_the_data_1675325517064}
Does the privacy notice disclose the identities of third parties with whom data may be shared?
Ans: {field:18_does_the_privacy_notice_disclose_the_identities_of_third_parties_with_whom_data_may_be_shared_1675325547225}
Does the privacy notice disclose the purposes for which personal data may be transferred across borders?
Ans: {field:19_does_the_privacy_notice_disclose_the_purposes_for_which_personal_data_may_be_transferred_across_borders_1675325566600}
Does the privacy notice disclose the instances in which personal data may be transferred to another jurisdiction with inadequate data protection safeguards?
Ans: {field:20_does_the_privacy_notice_disclose_the_instances_in_which_personal_data_may_be_transferred_to_another_jurisdiction_with_inadequate_data_protection_safeguards_1675325588985}
Does the privacy notice disclose the security safeguards that have been adopted to safeguard personal data?
Ans: {field:21_does_the_privacy_notice_disclose_the_security_safeguards_that_have_been_adopted_to_safeguard_personal_data_1675325614378}
Does the privacy notice disclose policyholders’ rights over their personal data?
Ans: {field:22_does_the_privacy_notice_disclose_policyholders_rights_over_their_personal_data_1675325634449}
Does the privacy notice disclose the use of automated means in processing data?
Ans: {field:23_does_the_privacy_notice_disclose_the_use_of_automated_means_in_processing_data_1675325684668}
Does the privacy notice prominently provide details about grievance redressal mechanisms for reporting misuse or breach of data?
Ans: {field:24_does_the_privacy_notice_prominently_provide_details_about_grievance_redressal_mechanisms_for_reporting_misuse_or_breach_of_data_1675325732416}
Have the details of the grievance redress officer and the data protection officer been published clearly in the privacy notice?
Ans: {field:25_have_the_details_of_the_grievance_redress_officer_and_the_data_protection_officer_been_published_clearly_in_the_privacy_notice_1675325761296}
Does the privacy notice inform how policyholders can contest or seek explanation for decisions made through automated means?
Ans: {field:26_does_the_privacy_notice_inform_how_policyholders_can_contest_or_seek_explanation_for_decisions_made_through_automated_means_1675325808197}

Obtaining Informed Consent From Policyholders

Have policyholders been given all the information about how their personal data will be processed?
Ans: {field:27_have_policyholders_been_given_all_the_information_about_how_their_personal_data_will_be_processed_1675329607956}
Have policyholders been given information about primary and secondary purposes for processing personal data?
Ans: {field:28_have_policyholders_been_given_information_about_primary_and_secondary_purposes_for_processing_personal_data_1675329625948}
Are policyholders informed of the potential risks of giving consent?
Ans: {field:29_are_policyholders_informed_of_the_potential_risks_of_giving_consent_1675329657500}
Are policyholders informed of measures that have been taken to mitigate risks to personal data?
Ans: {field:30_are_policyholders_informed_of_measures_that_have_been_taken_to_mitigate_risks_to_personal_data_1675329674302}
Are policyholders informed of the use of automated systems for providing products and services?
Ans: {field:31_are_policyholders_informed_of_the_use_of_automated_systems_for_providing_products_and_services_1675329695821}
Have the policyholders been briefed about the rationale, implications and intended effects of processing personal data through automated means?
Ans: {field:32_have_the_policyholders_been_briefed_about_the_rationale_implications_and_intended_effects_of_processing_personal_data_through_automated_means_1675329742062}
Do any of the terms and conditions in the notice make it hard for policyholders to give consent freely?
Ans: {field:33_do_any_of_the_terms_and_conditions_in_the_notice_make_it_hard_for_policyholders_to_give_consent_freely_1675329832369}
Can policyholders seek guidance in understanding privacy notices and the implications of giving consent?
Ans: {field:34_can_policyholders_seek_guidance_in_understanding_privacy_notices_and_the_implications_of_giving_consent_1675329862059}
Is consent taken expressly from policyholders?
Ans: {field:35_is_consent_taken_expressly_from_policyholders_1675329897378}
Are policyholders allowed to give consent separately for the different purposes of processing personal data?
Ans: {field:36_are_policyholders_allowed_to_give_consent_separately_for_the_different_purposes_of_processing_personal_data_1675329925087}
Are policyholders allowed to withdraw their consent as easily as they were able to give consent?
Ans: {field:37_are_policyholders_allowed_to_withdraw_their_consent_as_easily_as_they_were_able_to_give_consent_1675330243800}
Are policyholders allowed to manage their consent preferences through entities like consent managers?
Ans: {field:38_are_policyholders_allowed_to_manage_their_consent_preferences_through_entities_like_consent_managers_1675330266965}
Do policyholders have a common channel for giving and withdrawing their consent?
Ans: {field:39_do_policyholders_have_a_common_channel_for_giving_and_withdrawing_their_consent_1675330285981}
Are policyholders allowed to provide consent through visual and aural channels?
Ans: {field:40_are_policyholders_allowed_to_provide_consent_through_visual_and_aural_channels_1675330307776}
Have processes been designed to provide notice and take consent from differently-abled policyholders?
Ans: {field:41_have_processes_been_designed_to_provide_notice_and_take_consent_from_differently-abled_policyholders_1675330338951}
Is fresh consent taken from policyholders when new personal data is collected, or new processing activities are started?
Ans: {field:42_is_fresh_consent_taken_from_policyholders_when_new_personal_data_is_collected_or_new_processing_activities_are_started_1675330357263}
Are policyholders able to withdraw their consent for mandatory processing activities without detriment other than termination of services?
Ans: {field:43_are_policyholders_able_to_withdraw_their_consent_for_mandatory_processing_activities_without_detriment_other_than_termination_of_services_1675330377214}
Can policyholders refuse consent for optional processing activities without facing detriment to the services they receive?
Ans: {field:44_can_policyholders_refuse_consent_for_optional_processing_activities_without_facing_detriment_to_the_services_they_receive_1675330396845}
Are policyholders charged fee for withdrawing consent?
Ans: {field:45_are_policyholders_charged_fee_for_withdrawing_consent_1675330420791}
Are records maintained of policyholders’ consent preferences, consent withdrawals and correspondence at the time of obtaining consent?
Ans: {field:46_are_records_maintained_of_policyholders_consent_preferences_consent_withdrawals_and_correspondence_at_the_time_of_obtaining_consent_1675330448367}

Collecting Accurate And Proportionate Personal Data For Providing Insurance

Is the personal data processed necessary for the purpose of processing?
Ans: {field:47_is_the_personal_data_processed_necessary_for_the_purpose_of_processing_1675330523963}
Is the personal data processed relevant for the purpose of processing?
Ans: {field:48_is_the_personal_data_processed_relevant_for_the_purpose_of_processing_1675330546083}
Is the data used for processing accurate, complete, representative, unbiased and up to date?
Ans: {field:49_is_the_data_used_for_processing_accurate_complete_representative_unbiased_and_up_to_date_1675330564638}
Is unnecessary personal data deleted promptly?
Ans: {field:50_is_unnecessary_personal_data_deleted_promptly_1675330587491}
Is the personal data collected with the policyholders’ consent?
Ans: {field:51_is_the_personal_data_collected_with_the_policyholders_consent_1675330606479}
Is the personal data collected through lawful means?
Ans: {field:52_is_the_personal_data_collected_through_lawful_means_1675330629175}
Is new personal data collected only when it is necessary for maintaining data accuracy or for fulfilling a purpose?
Ans: {field:53_is_new_personal_data_collected_only_when_it_is_necessary_for_maintaining_data_accuracy_or_for_fulfilling_a_purpose_1675330661421}
Are Data Protection Impact Assessments (DPIA) conducted to ensure proportionate personal data in processed?
Ans: {field:54_are_data_protection_impact_assessments_dpia_conducted_to_ensure_proportionate_personal_data_in_processed_1675330680681}
Is the quality of personal data frequently assessed for processing?
Ans: {field:55_is_the_quality_of_personal_data_frequently_assessed_for_processing_1675330701331}
Are there mechanisms to filter incomplete, inaccurate, or unnecessary personal data during data collection?
Ans: {field:56_are_there_mechanisms_to_filter_incomplete_inaccurate_or_unnecessary_personal_data_during_data_collection_1675330720601}
Are there protocols for assessing the quality of data collected from third parties?
Ans: {field:57_are_there_protocols_for_assessing_the_quality_of_data_collected_from_third_parties_1675330739011}
When using automated means, is the quality of outputs reviewed regularly when they are used for further processing activities?
Ans: {field:58_when_using_automated_means_is_the_quality_of_outputs_reviewed_regularly_when_they_are_used_for_further_processing_activities_1675330836281}
Are there measures to review the processing activities to identify and rectify the causes of bad data quality?
Ans: {field:59_are_there_measures_to_review_the_processing_activities_to_identify_and_rectify_the_causes_of_bad_data_quality_1675330866928}
Are there mechanisms to identify and rectify inaccuracies and alterations in personal data caused due to breach or cyberattack?
Ans: {field:60_are_there_mechanisms_to_identify_and_rectify_inaccuracies_and_alterations_in_personal_data_caused_due_to_breach_or_cyberattack_1675330898093}
Are records maintained of the source from which personal data was collected?
Ans: {field:61_are_records_maintained_of_the_source_from_which_personal_data_was_collected_1675330919404}
Are records maintained of the measures taken to check the accuracy of data?
Ans: {field:62_are_records_maintained_of_the_measures_taken_to_check_the_accuracy_of_data_1675331078487}
Are records maintained of inaccuracies in personal data?
Ans: {field:63_are_records_maintained_of_inaccuracies_in_personal_data_1675331332262}
Are records maintained of policyholders’ challenges to the accuracy of personal data?
Ans: {field:64_are_records_maintained_of_policyholders_challenges_to_the_accuracy_of_personal_data_1675331365892}

Securing Policyholders’ Personal Data

Are information audits conducted to assess the inventory of the personal data?
Ans: {field:65_are_information_audits_conducted_to_assess_the_inventory_of_the_personal_data_1675331427164}
Is the personal data inventory frequently revised and updated? data?
Ans: {field:66_is_the_personal_data_inventory_frequently_revised_and_updated_1675331444874}
Are information audits conducted to understand vulnerabilities and risks to personal data?
Ans: {field:67_are_information_audits_conducted_to_understand_vulnerabilities_and_risks_to_personal_data_1675331469682}
Are risk assessments and threat tests conducted to understand risks to personal data?
Ans: {field:68_are_risk_assessments_and_threat_tests_conducted_to_understand_risks_to_personal_data_1675331488213}
Are the data protection impact assessments (DPIAs) and threat analyses conducted before using new technology for processing personal data?
Ans: {field:69_are_the_data_protection_impact_assessments_dpias_and_threat_analyses_conducted_before_using_new_technology_for_processing_personal_data_1675331586580}
Have anonymisation and de-identification techniques been implemented to secure personal data?
Ans: {field:70_have_anonymisation_and_de-identification_techniques_been_implemented_to_secure_personal_data_1675331611531}
Are anonymised datasets reviewed continuously for the risk of reidentification?
Ans: {field:71_are_anonymised_datasets_reviewed_continuously_for_the_risk_of_reidentification_1675331639364}
Have technological measures, including encryption and passwords, been adopted for personal data protection?
Ans: {field:72_have_technological_measures_including_encryption_and_passwords_been_adopted_for_personal_data_protection_1675331664819}
Have organisational measures, including data access, data authentication and authorisation protocols, been adopted for personal data protection?
Ans: {field:73_have_organisational_measures_including_data_access_data_authentication_and_authorisation_protocols_been_adopted_for_personal_data_protection_1675331686187}
Have physical measures, including security clearances to personal data servers, been adopted for personal data protection?
Ans: {field:74_have_physical_measures_including_security_clearances_to_personal_data_servers_been_adopted_for_personal_data_protection_1675331705437}
Are data protection guarantees in the privacy notice operationalised through security safeguards?
Ans: {field:75_are_data_protection_guarantees_in_the_privacy_notice_operationalised_through_security_safeguards_1675331722612}
Has a data breach and incident management process been established?
Ans: {field:76_has_a_data_breach_and_incident_management_process_been_established_1675331745163}
Does the data breach and incident management process help in addressing existing vulnerabilities and threats to personal data?
Ans: {field:77_does_the_data_breach_and_incident_management_process_help_in_addressing_existing_vulnerabilities_and_threats_to_personal_data_1675331764714}
Does the data breach and incident management process enable policyholders to take steps to mitigate risks to personal data?
Ans: {field:78_does_the_data_breach_and_incident_management_process_enable_policyholders_to_take_steps_to_mitigate_risks_to_personal_data_1675331785955}
Are the risks that could arise from outsourcing personal data to third parties assessed preemptively?
Ans: {field:79_are_the_risks_that_could_arise_from_outsourcing_personal_data_to_third_parties_assessed_preemptively_1675331811299}
Are there controls to ensure third parties use personal data only to fulfil the purposes mentioned in the outsourcing agreement?
Ans: {field:80_are_there_controls_to_ensure_third_parties_use_personal_data_only_to_fulfil_the_purposes_mentioned_in_the_outsourcing_agreement_1675331876026}
Are measures taken to ensure that the third parties have adequate security safeguards to protect personal data?
Ans: {field:81_are_measures_taken_to_ensure_that_the_third_parties_have_adequate_security_safeguards_to_protect_personal_data_1675332087243}
Have breach notification requirements been included in outsourcing agreements with third parties?
Ans: {field:82_have_breach_notification_requirements_been_included_in_outsourcing_agreements_with_third_parties_1675332112100}
Are there measures in place to monitor personal data flows through Application Programming Interfaces (APIs) with third parties?
Ans: {field:83_are_there_measures_in_place_to_monitor_personal_data_flows_through_application_programming_interfaces_apis_with_third_parties_1675332136644}
Is the use of APIs by third parties audited for data malpractices?
Ans: {field:84_is_the_use_of_apis_by_third_parties_audited_for_data_malpractices_1675332364680}
Is personal data that is not relevant for processing by third parties deleted or anonymised when shared with third parties?
Ans: {field:85_is_personal_data_that_is_not_relevant_for_processing_by_third_parties_deleted_or_anonymised_when_shared_with_third_parties_1675332391439}
Are measures taken to ensure personal data is deleted carefully without giving access to unauthorised parties?
Ans: {field:86_are_measures_taken_to_ensure_personal_data_is_deleted_carefully_without_giving_access_to_unauthorised_parties_1675332406731}
Are there controls to recover accidentally lost, altered or destroyed personal data?
Ans: {field:87_are_there_controls_to_recover_accidentally_lost_altered_or_destroyed_personal_data_1675332431828}
Are security safeguards regularly reviewed through audits, assessments and threat tests?
Ans: {field:88_are_security_safeguards_regularly_reviewed_through_audits_assessments_and_threat_tests_1675332453987}
Are automated means of processing periodically rectified for vulnerabilities identified in audits and assessments?
Ans: {field:89_are_automated_means_of_processing_periodically_rectified_for_vulnerabilities_identified_in_audits_and_assessments_1675332476352}
Are privacy-by-design principles implemented and operationalised throughout the data lifecycle?
Ans: {field:90_are_privacy-by-design_principles_implemented_and_operationalised_throughout_the_data_lifecycle_1675332495563}
Are security-by-design principles implemented and operationalised throughout the data lifecycle?
Ans: {field:91_are_security-by-design_principles_implemented_and_operationalised_throughout_the_data_lifecycle_1675332627371}

Using Or Disclosing Personal Data With The Consent Of The Policyholder

Is a specific list of third parties to whom personal data may be disclosed maintained?
Ans: {field:92_is_a_specific_list_of_third_parties_to_whom_personal_data_may_be_disclosed_maintained_1675332652187}
Has the policyholder been provided with a standard list of third parties to whom personal data may be disclosed?
Ans: {field:93_has_the_policyholder_been_provided_with_a_standard_list_of_third_parties_to_whom_personal_data_may_be_disclosed_1675332667873}
Is a list of purposes for which personal data may be shared to third parties disclosed to policyholders?
Ans: {field:94_is_a_list_of_purposes_for_which_personal_data_may_be_shared_to_third_parties_disclosed_to_policyholders_1675332687346}
Have personal data disclosures to third parties stopped after policyholders have withdrawn consent?
Ans: {field:95_have_personal_data_disclosures_to_third_parties_stopped_after_policyholders_have_withdrawn_consent_1675332706572}
Have mechanisms been installed to receive and record data porting requests from policyholders?
Ans: {field:96_have_mechanisms_been_installed_to_receive_and_record_data_porting_requests_from_policyholders_1675332727035}
Are there organisation-level policies to recognise and operationalise data porting requests?
Ans: {field:97_are_there_organisation-level_policies_to_recognise_and_operationalise_data_porting_requests_1675332756308}
Has capacity been developed in the organisation to recognise and operationalise data porting requests?
Ans: {field:listradio_1675332778996}
Have measures been adopted to respond to porting requests in a timely manner?
Ans: {field:99_have_measures_been_adopted_to_respond_to_porting_requests_in_a_timely_manner_1675332796927}
Has the identity of the requesting policyholder been verified before transmitting data?
Ans: {field:100_has_the_identity_of_the_requesting_policyholder_been_verified_before_transmitting_data_1675332831618}
Have measures been adopted to receive and transmit personal data to third parties on policyholders’ request?t?
Ans: {field:101_have_measures_been_adopted_to_receive_and_transmit_personal_data_to_third_parties_on_policyholders_request_1675332864739}
Can policyholders request for porting information at reasonable cost?
Ans: {field:102_can_policyholders_request_for_porting_information_at_reasonable_cost_1675332876299}
Is personal data transmitted on policyholders’ request without placing legal or technical obstacles?
Ans: {field:103_is_personal_data_transmitted_on_policyholders_request_without_placing_legal_or_technical_obstacles_1675332895613}
Is personal data transmitted on policyholders’ request in a structured, commonly used and machine-readable format?
Ans: {field:104_is_personal_data_transmitted_on_policyholders_request_in_a_structured_commonly_used_and_machine-readable_format_1675332939587}
Is personal data transmitted on policyholders’ request in a secure method?
Ans: {field:105_is_personal_data_transmitted_on_policyholders_request_in_a_secure_method_1675332934109}
Is the assessment of policyholder maintained distinctly from policyholders’ personal data?
Ans: {field:106_is_the_assessment_of_policyholder_maintained_distinctly_from_policyholders_personal_data_1675332968540}

Enabling Policyholders To Access And Rectify Their Personal Data

Are personal data access and rectification processes clearly communicated to policyholders?
Ans: {field:107_are_personal_data_access_and_rectification_processes_clearly_communicated_to_policyholders_1675333040680}
Are policyholders able to access their own personal data in a structured, machine-readable format?
Ans: {field:108_are_policyholders_able_to_access_their_own_personal_data_in_a_structured_machine-readable_format_1675333063121}
Are policyholders able to access and rectify their personal data collected indirectly from third parties?
Ans: {field:109_are_policyholders_able_to_access_and_rectify_their_personal_data_collected_indirectly_from_third_parties_1675333080218}
Are policyholders able to access and rectify their personal data when they choose to without cost or delay?
Ans: {field:110_are_policyholders_able_to_access_and_rectify_their_personal_data_when_they_choose_to_without_cost_or_delay_1675333098788}
Do policyholders have the choice to rectify personal data through different physical and digital channels?
Ans: {field:111_do_policyholders_have_the_choice_to_rectify_personal_data_through_different_physical_and_digital_channels_1675333119193}
Have changes been made to all personal data records to match the modifications made by policyholders?
Ans: {field:112_have_changes_been_made_to_all_personal_data_records_to_match_the_modifications_made_by_policyholders_1675333138955}
Have measures been taken to ensure that third parties rectify their personal data records?
Ans: {field:113_have_measures_been_taken_to_ensure_that_third_parties_rectify_their_personal_data_records_1675333170898}
Have amended personal data records been provided to third parties after policyholders have made changes?
Ans: {field:114_have_amended_personal_data_records_been_provided_to_third_parties_after_policyholders_have_made_changes_1675333272443}

Using Automated Means Of Processing Responsibly

Are there measures to ensure transparency, accountability and explainability of decisions made by automated means?
Ans: {field:115_are_there_measures_to_ensure_transparency_accountability_and_explainability_of_decisions_made_by_automated_means_1675333364792}
Can the factors and processes used by the automated means be explained in simple, clear and comprehensible terms to policyholders?
Ans: {field:116_can_the_factors_and_processes_used_by_the_automated_means_be_explained_in_simple_clear_and_comprehensible_terms_to_policyholders_1675333384611}
Are there records of the actions taken to identify, document and mitigate risks from automated means to policyholders’ rights?
Ans: {field:117_are_there_records_of_the_actions_taken_to_identify_document_and_mitigate_risks_from_automated_means_to_policyholders_rights_1675333410820}
Are there records of the datasets and processes used by automated means to arrive at decisions?
Ans: {field:118_are_there_records_of_the_datasets_and_processes_used_by_automated_means_to_arrive_at_decisions_1675333428522}
Have the automated means of processing been sandboxed or piloted to preemptively identify risks to policyholders?
Ans: {field:119_have_the_automated_means_of_processing_been_sandboxed_or_piloted_to_preemptively_identify_risks_to_policyholders_1675333515517}
Are the automated means designed to be fit for the purpose of processing?
Ans: {field:120_are_the_automated_means_designed_to_be_fit_for_the_purpose_of_processing_1675333536309}
Have the robustness and security of automated means been tested before being put into use?
Ans: {field:121_have_the_robustness_and_security_of_automated_means_been_tested_before_being_put_into_use_1675333557361}
Have the reliability and accuracy of outputs produced by the automated means been tested before being put into use?
Ans: {field:122_have_the_reliability_and_accuracy_of_outputs_produced_by_the_automated_means_been_tested_before_being_put_into_use_1675333576003}
Has it been demonstrated that the automated means of processing provide legitimate outputs without discrimination?
Ans: {field:123_has_it_been_demonstrated_that_the_automated_means_of_processing_provide_legitimate_outputs_without_discrimination_1675333596210}
Is the data being processed representative, unbiased and of high-quality?
Ans: {field:124_is_the_data_being_processed_representative_unbiased_and_of_high-quality_1675333617440}
Has the personal data that is being processed by automated means been de-biased?
Ans: {field:125_has_the_personal_data_that_is_being_processed_by_automated_means_been_de-biased_1675333640839}
Have the best standards been adopted for gathering and labelling personal data that will be used for processing by automated means?
Ans: {field:126_have_the_best_standards_been_adopted_for_gathering_and_labelling_personal_data_that_will_be_used_for_processing_by_automated_means_1675333656767}
Has bias in the decision-making process by automated means been identified and addressed?
Ans: {field:127_has_bias_in_the_decision-making_process_by_automated_means_been_identified_and_addressed_1675333685111}
Are automated means examined continually to identify vulnerabilities?
Ans: {field:128_are_automated_means_examined_continually_to_identify_vulnerabilities_1675333707399}
Are the personnel who develop and administrate automated means trained to ensure responsible processing?
Ans: {field:129_have_measures_been_adopted_to_mitigate_the_risks_identified_from_automated_means_1675333724297}
Are the personnel who develop and administrate automated means trained to ensure responsible processing?
Ans: {field:130_are_the_personnel_who_develop_and_administrate_automated_means_trained_to_ensure_responsible_processing_1675333743081}
Have policyholders been notified through all service delivery channels that automated means may be used for making decisions about them?
Ans: {field:131_have_policyholders_been_notified_through_all_service_delivery_channels_that_automated_means_may_be_used_for_making_decisions_about_them_1675333766860}
Are policyholders able to contest decisions made through automated means?
Ans: {field:132_are_policyholders_able_to_contest_decisions_made_through_automated_means_1675333784163}
Are policyholders able to submit complaints about decisions made through automated means?
Ans: {field:133_are_policyholders_able_to_submit_complaints_about_decisions_made_through_automated_means_1675333828242}
Are policyholders able to contest or seek review of decisions made through automated means?
Ans: {field:134_are_policyholders_able_to_contest_or_seek_review_of_decisions_made_through_automated_means_1675333821308}
Are policyholders able to seek redress when their rights are harmed by processing by automated means?
Ans: {field:135_are_policyholders_able_to_seek_redress_when_their_rights_are_harmed_by_processing_by_automated_means_1675333845754}
Do policyholders have access to data management tools that can help them review, edit, and update personal data that is processed through automated means?
Ans: {field:136_do_policyholders_have_access_to_data_management_tools_that_can_help_them_review_edit_and_update_personal_data_that_is_processed_through_automated_means_1675333897161}
Have policyholders been made aware of their rights about how their personal data is processed through automated means?
Ans: {field:137_have_policyholders_been_made_aware_of_their_rights_about_how_their_personal_data_is_processed_through_automated_means_1675333890985}

Demonstrating Compliance With Best Data Protection Practices

Are there protocols for the collection of personal data?
Ans: {field:138_are_there_protocols_for_the_collection_of_personal_data_1675333967834}
Are there protocols for controlling access to personal data?
Ans: {field:139_are_there_protocols_for_controlling_access_to_personal_data_1675333975484}
Are there protocols for retaining and deleting personal data?
Ans: {field:140_are_there_protocols_for_retaining_and_deleting_personal_data_1675333993077}
Are there protocols for managing personal data breaches and other cyber incidents?
Ans: {field:141_are_there_protocols_for_managing_personal_data_breaches_and_other_cyber_incidents_1675334012094}
Are there protocols for imparting data-privacy training to personnel?
Ans: {field:142_are_there_protocols_for_imparting_data-privacy_training_to_personnel_1675334037478}
Are there data policies in place that define the means to ensure data quality?
Ans: {field:143_are_there_data_policies_in_place_that_define_the_means_to_ensure_data_quality_1675334059726}
Are there data policies in place that define security safeguards?
Ans: {field:144_are_there_data_policies_in_place_that_define_security_safeguards_1675334076356}
Are personnel trained to answer inquiries about privacy policies, consent processes, security safeguards and redressal processes?
Ans: {field:145_are_personnel_trained_to_answer_inquiries_about_privacy_policies_consent_processes_security_safeguards_and_redressal_processes_1675334093403}
Are personnel appointed for monitoring compliance with data protection law and ensuring best practices in data protection?
Ans: {field:146_are_personnel_appointed_for_monitoring_compliance_with_data_protection_law_and_ensuring_best_practices_in_data_protection_1675334113092}
Are the names of personnel responsible for data protection practices published for policyholders’ reference?
Ans: {field:147_are_the_names_of_personnel_responsible_for_data_protection_practices_published_for_policyholders_reference_1675334131275}
Is there an effective, efficient, speedy and time-bound grievance redressal mechanism in place that can help policyholders resolve data-related grievances?
Ans: {field:148_is_there_an_effective_efficient_speedy_and_time-bound_grievance_redressal_mechanism_in_place_that_can_help_policyholders_resolve_data-related_grievances_1675334147906}
Are the redressal mechanisms simple?
Ans: {field:149_are_the_redressal_mechanisms_simple_1675334167925}
Are policyholders able to seek redress through both digital and physical channels?
Ans: {field:150_are_policyholders_able_to_seek_redress_through_both_digital_and_physical_channels_1675334190492}
Have redressal channels been leveraged to gain feedback directly from policyholders?
Ans: {field:151_have_redressal_channels_been_leveraged_to_gain_feedback_directly_from_policyholders_1675334214067}
Are audits conducted to assess the effectiveness of privacy notices, security safegWuards and key data protection practices?
Ans: {field:152_are_audits_conducted_to_assess_the_effectiveness_of_privacy_notices_security_safegwuards_and_key_data_protection_practices_1675334234187}
Have risk assessment frameworks for processing personal data been established?
Ans: {field:153_have_risk_assessment_frameworks_for_processing_personal_data_been_established_1675334253172}
Are third party service providers informed about past vulnerabilities and attacks?
Ans: {field:154_are_third_party_service_providers_informed_about_past_vulnerabilities_and_attacks_1675334275579}
Are records of the source from where personal data was collected maintained?
Ans: {field:155_are_records_of_the_source_from_where_personal_data_was_collected_maintained_1675334297132}
Are records of the measures taken to check accuracy of data maintained?
Ans: {field:156_are_records_of_the_measures_taken_to_check_accuracy_of_data_maintained_1675334314146}
Are records of the processing activities that were undertaken with the personal data maintained?
Ans: {field:157_are_records_of_the_processing_activities_that_were_undertaken_with_the_personal_data_maintained_1675334330710}
Are records of the disclosure of personal data to third parties maintained?
Ans: {field:158_are_records_of_the_disclosure_of_personal_data_to_third_parties_maintained_1675334349832}
Are records of the security safeguards installed maintained?
Ans: {field:159_are_records_of_the_security_safeguards_installed_maintained_1675334373164}