PrivacyVault

Free Privacy Scan

12 questions. 3 minutes. Find out where your privacy gaps are — before a regulator does.

Phase 1: Core Privacy Practices
1 of 12
Does your organisation collect personal data from customers, employees, or website visitors?
Why this matters: If you collect names, emails, phone numbers, or any identifying information — you are a data controller under the Privacy Act, GDPR, and PDPA.
Yes, we collect personal data
Names, emails, phones, addresses, payment details, or other PII
Limited — only employee data
We collect employee HR data but not customer personal data
Not sure
I don’t know what personal data we collect
No personal data collected
We don’t collect or process any PII
Phase 1: Core Privacy Practices
2 of 12
Do you have a published privacy policy on your website?
Legal requirement: Under Privacy Act APP 1, GDPR Art. 13-14, and PDPA, a clear, accessible privacy policy is mandatory.
Yes, reviewed in last 12 months
Published, current, covers all data practices
Yes, but outdated
Haven’t reviewed recently
No privacy policy
Nothing published on our website
Phase 1: Core Privacy Practices
3 of 12
Do you track consent for marketing communications and data processing?
Context: GDPR requires explicit, purpose-specific consent. Privacy Act requires consent for direct marketing. Without records, you cannot prove compliance during audit.
Per-purpose consent with audit trail
Track per subject, per purpose, with timestamps
Basic opt-in only
Newsletter checkbox, no per-purpose tracking
No formal consent tracking
Phase 1: Core Privacy Practices
4 of 12
Do you know where all personal data is stored across your systems?
Context: A data inventory (ROPA under GDPR Art. 30) is the foundation. You cannot protect what you cannot find. First thing an auditor asks for.
Complete data inventory maintained
Know what data, which systems, what purpose, what legal basis
Partial — some but not all mapped
Data spread across many systems, not fully mapped
No data inventory
Phase 2: Data Subject Rights
5 of 12
Could someone submit a data access, correction, or deletion request to you today?
Legal requirement: Under Privacy Act APP 12-13 and GDPR Art. 15-20, you must respond within 30 days. Failure triggers regulatory investigation.
Documented process and portal
Public form, identity verification, SLA tracking
Handle manually via email
Would respond but no formal process
No process — wouldn’t know what to do
Phase 2: Data Subject Rights
6 of 12
Do you track who accesses personal data, and can data subjects see who viewed their information?
Why this matters: Data access request tracking is essential for breach investigations, DSAR fulfilment, and demonstrating accountability under GDPR Art. 5(2). Consumer-facing access logs build trust.
Full audit trail with consumer visibility
Log all PI access events; data subjects can see who accessed their data
Internal audit logs only
Logged internally but subjects cannot view
No access tracking
Phase 3: Data Protection & Security
7 of 12
Do you have a data breach response plan?
Legal requirement: NDB scheme requires OAIC notification within 30 days. GDPR: 72 hours. Without a plan, you face penalties up to A$50M.
Documented and tested (tabletop exercises)
Plan, assigned roles, simulation exercises conducted
Basic plan — not tested
Written plan but no staff training or simulation
No breach response plan
Phase 3: Data Protection & Security
8 of 12
Do you obfuscate or encrypt personal data based on its classification and sensitivity level?
Why this matters: Health records, financial data, and biometric data require stronger protection than email addresses. Data-at-rest encryption, tokenisation, masking reduce breach impact. Required under Privacy Act APP 11 and GDPR Art. 32.
Classified and protected accordingly
Data classified by sensitivity; encryption, masking, or tokenisation per level
Some encryption, no classification
Encrypt at rest and transit but no sensitivity classification
TLS only, no data-at-rest encryption
HTTPS but PI stored unencrypted in databases
No encryption or obfuscation
Phase 3: Data Protection & Security
9 of 12
Do you have data access authorisation policies controlling who can view personal data?
Why this matters: GDPR Art. 25 and Privacy Act APP 11 require restricting PI access to authorised personnel only. RBAC, least privilege, and separation of duties prevent unauthorised exposure.
RBAC with regular access reviews
Least privilege enforced, quarterly reviews, SoD
Basic controls, no formal policy
Some restrictions but no documented policy or reviews
Broad access — most staff see most data
Limited restrictions on who views PI
No access controls on personal data
Phase 4: Cross-Border & Vendor Management
10 of 12
Is personal data transferred to or processed in countries outside your jurisdiction?
Why this matters: Under Privacy Act APP 8, overseas recipients must handle data per the APPs. GDPR Art. 44-49 restricts transfers without adequacy decisions. Using AWS US-East, Google Analytics, or Salesforce counts as cross-border transfer.
Yes — with contractual safeguards (SCCs/DPAs)
Transfer overseas with Standard Contractual Clauses in place
Yes — but no specific safeguards
Use overseas cloud without specific transfer agreements
Not sure where providers store data
All data stays in-country
Phase 4: Cross-Border & Vendor Management
11 of 12
Do you have Data Processing Agreements (DPAs) with vendors who process personal data?
Legal requirement: GDPR Art. 28 mandates DPAs with all processors. Without them, you are liable for your vendors’ data handling failures.
DPAs with all PI-processing vendors
Signed DPAs covering data handling, breach notification, deletion
Some vendors — not all
No DPAs in place
Phase 4: Cross-Border & Vendor Management
12 of 12
Do you have data retention and deletion policies?
Why this matters: GDPR Art. 5(1)(e) requires data minimisation. Privacy Act APP 11.2 requires destruction when no longer needed. Keeping data longer increases breach risk.
Documented and enforced with automated deletion
Retention schedules, automated expiry, active deletion
Documented but not enforced
Policy exists but data not actively deleted on expiry
No retention policy