1. Do you know what personal data you hold?
A simple data map, even a spreadsheet, is the foundation for everything else.
2. Can you explain why you process it?
Every use of personal data needs a lawful basis. Write it down next to each process.
3. Could you answer a data subject request this week?
Decide who receives requests, where data lives and how long you will take to respond.
4. Do you know what you would do after a breach?
A one-page response plan with named contacts is enough to begin with.
5. Does someone own data protection?
Many organisations benefit from a designated Data Protection Officer, in-house or outsourced.
