Data protection Audit for the IMA

Scope - Full GDPR audit of organisations data and practices Objectives a. identify all collection and processing of personal data across the IMA, b. identify all data policies and procedures across the IMA, c. check compliance of the collection and processing of personal data in (a) and the policies and procedures in (b) with the legislative framework, d. identify discrepancies between all IMA policies and findings of (a) and (b) and (c). e. provide a solutions paper to address the discrepancies found

Key outcomes - The audit will result in recommendations where policies and processes need to be updated or created or where gaps or errors in various documents are identified, such as our privacy notices or schedule of retention. These recommendations will then need to be actioned. Those actions will fall outside the remit of the audit, but the recommendations could suggest which areas require prioritisation. The actions will be owned by the Information Governance Lead, who will be the acting Data Protection Officer (DPO) within the IMA. This role is being recruited for and we expect a candidate to be in situ for early 2023.