- Does your business need a data protection officer? Have you provided contact information of the DPO (or his/her representative) in every document or material that contains personal information?

- Choose an appropriate lawful basis for each processing. If you cannot find a specific legal basis to justify your data processing, a consent from the data owner must be obtained. In this regard, have you prepared a Consent Form?

- Prepare a RoPA (Record of Processing Activities) and train your personnel on how to complete such a document to enhance your personal data protection system and show your accountability before the Personal Data Protection Commission.

- Prepare a Privacy Policy containing the purposes for which personal information will be collected, used and disclosed, including the retention period, and inform the data owners of such policy.

- Prepare a data breach contingency plan where each breach must be notified to the Personal Data Protection Commission within 72 hours after knowing of the situation.

- Don’t forget to have in place a system that facilitates the exercise of PDPA rights.

- Inspect and improve your IT security system;

- Grant access to personal information to authorized persons only and prevent any unauthorized access to such information.

- Train your personnel on PDPA; raise awareness about personal data protection within your organization e.g. keep documents in a locked cabinet, turn off your desktop monitor when leaving etc. to prevent data breach from human errors.

- Carry out a Data Protection Impact Assessment (DPIA) if any high risk occurs and needs to be complied with the PDPA standards.