Do you have a data protection policy?
Do you have a data retention policy?
Do you have a procedure in place to handle data breaches?
Do you have a procedure in place to handle subject access requests?
Do you have a procedure in place to handle complaints?
Do you have a procedure in place to monitor data protection compliance?
What data protection training do you provide to your employees?
Do you have a data protection officer?
What is the name and contact information of your data protection officer?
What is the legal basis for collecting and processing data?
What are the rights of the data subjects?
What are the security measures in place to protect data?