{"text_format":"1","workbook":"xlsx","n_sheets":5,"sheets":["1. Control Sheet","2. Instruction","3. Data Protection Self-Assessm","4. Summary report","5. Answer reference sheet"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"1. Control Sheet","index":0,"n_rows":19,"n_cols":4,"rows_kept":19,"cut":false,"hidden":true,"merged":[[15,1,15,2],[15,3,15,4],[18,1,18,4]]}
[]
[null,"Document Control "]
[null,"Document Title","Data Protection Self-Assessment"]
[null,"Document Type ","Assessment sheet"]
[null,"Version",2]
[null,"Document Reference","PDPPL-02050701E"]
[null,"Document Owner ","CGAA"]
[null,"Document Classification","External"]
[]
[null,"Document History "]
[null,"Version Number ","Description ","Date"]
[null,1,"Internal V1.0 document","August 2020"]
[null,2,"Aligned to NCSA Branding","2022-09-01"]
[null,"Related Documents "]
[null,"Document Reference ",null,"Document Title "]
[null,"PDPPL-01050701E",null,"Data Protection Self-Assessment (English)"]
[]
[null,"Internal Notes"]
[null,"This workbook consists of 5 sheets:\n1. Control Sheet: Serves as a version control sheet to assist in monitoring changes.\n2. Instruction - End user: Guide to assist in understanding the purpose of this document and how to use it.\n3. Data Protection Self-Assessment - End user: This is the assessment sheet. Prior to conducting the assessment, ensure that all answers in column E are cleared, then proceed with answering the questions by selecting the answer most relevant to your organisation.\n4. Summary report - End user: Upon completing the assessment on sheet 3, this will provide you with a summary of high level recommendations based on your answers.\n5. Answer reference sheet: This is the data sheet used to maintain the information contained in sheet 3 and 4, it consists of all the questions and answers, kindly use this sheet to edit the assessment if needed."]

{"sheet":"2. Instruction","index":1,"n_rows":17,"n_cols":3,"rows_kept":17,"cut":false,"hidden":false,"merged":[[14,2,14,4],[15,1,15,4],[16,1,16,4],[3,1,3,4],[4,1,4,4],[5,1,5,4],[6,1,6,4],[7,1,7,4],[10,1,10,4],[8,2,8,4],[9,2,9,4],[11,1,11,4],[12,2,12,4],[13,2,13,4]]}
[]
[]
[]
[null,"Introduction"]
[null,"This Self-Assessment Checklist will be most helpful for small to medium sized organisations across all sectors. It acts as an orientation tool to enable organisations to identify key areas of focus against the data privacy concepts addressed in the PDPPL, orient their reading and knowledge development towards key relevant guidelines and develop the maturity of their data privacy programme to enhance their reputation, customer confidence and data privacy risk management."]
[null,"Instructions"]
[null,"1. To conduct a Self-Assessment of your organisation's PDPPL compliance, click the \"Begin Self-Assessment\" button above. You should only check one answer per question in the yellow column within the Self-Assessment. \nShould you wish to restart the Self-Assessment, simply click the \"Restart Self-Assessment\" button which will clear your answers. Prior to conducting the assessment, ensure that all answers in column E are cleared, then proceed with answering the questions by selecting the answer most relevant to your organisation.\n2. Once the Self-Assessment Checklist has been completed, click on the \"Produce Report\" button to obtain a high-level summary of initial considerations that should be made based on the answers provided in the Checklist when planning actions to further improve your organisation's data privacy compliance maturity. Please note that completion of the recommended considerations within the report produced will not guarantee compliance on the part of the organisation. Organisations are accountable for their own compliance and must refer to the key referenced guidelines for each question to obtain information on each subject alongside the PDPPL, all guidelines issued by the NCSA, and any related ministerial decisions."]
[null,"Column Colour Key"]
[null,null,"Column titles that are referenced with this colour consist of editable fields."]
[null,null,"Column titles that are referenced with this colour are restricted and are uneditable."]
[null,"Understanding your results"]
[null,"Upon completing the assessment and clicking \"Produce Report,\" a report will be provided with an overview of your results based on your answers. It will include one of the following ratings:"]
[null,"Green","Based on your answers, your organisation has a mature Data Privacy programme though some actions may still be required to meet a higher level of compliance. \nPlease note you should still seek to carry out a full programme of compliance against the PDPPL, as this assessment is not a substitute for reading, understanding, and acting upon the requirements of the PDPPL, guidelines issued by the NCSA, and any related ministerial decisions. "]
[null,"Amber","Based on your answers, your organisation has demonstrated it has some requisite elements of a Data Privacy programme however more activities need to be undertaken, and measures implemented, to demonstrate a higher level of compliance."]
[null,"Red","Based on your answers, your organisation does not currently have a comprehensive Data Privacy programme and will need to plan and conduct recommended activities to avoid disruption to the business, significant regulatory fines, legal claims and / or complaint from individuals."]
[null,"Disclaimer"]
[null,"o This Self-Assessment Checklist does not guarantee compliance with the PDPPL or the effectiveness of any controls in place and is intended to provide organisations with a starting point to orient their data privacy compliance programme. The potential actions provide controllers with guidance on compliance areas they should focus on and the guidelines that they should refer to.\no The information in this checklist is not exhaustive and should be read in conjunction with the PDPPL, guidelines issued by the NCSA, and any related ministerial decisions.\no The NCSA and/or the CGAA are not liable for any damages arising from the use of or inability to use these guidelines or any material contained in them, or from any action or decision taken as a result of using them. Anyone using this assessment may wish to consult a legal and/or professional adviser for legal or other advice in respect of these guidelines.\no Any changes to any part of this workbook, other than to check boxes in the Self-Assessment Checklist may mean that this workbook does not operate as intentded."]

{"sheet":"3. Data Protection Self-Assessm","index":2,"n_rows":64,"n_cols":9,"rows_kept":64,"cut":false,"hidden":false,"merged":[[31,4,33,4],[25,1,27,1],[28,1,30,1],[28,2,30,2],[28,3,30,3],[28,4,30,4],[31,1,33,1],[25,4,27,4],[25,2,27,2],[25,3,27,3],[31,2,33,2],[31,3,33,3],[34,4,36,4],[37,1,39,1],[37,2,39,2],[37,4,39,4],[43,1,45,1],[43,2,45,2],[43,3,45,3],[40,1,42,1],[40,2,42,2],[40,3,42,3],[40,4,42,4],[43,4,45,4],[19,4,21,4],[22,4,24,4],[7,1,9,1],[7,2,9,2],[7,3,9,3],[10,1,12,1],[10,2,12,2],[10,3,12,3],[7,4,9,4],[10,4,12,4],[13,4,15,4],[13,1,15,1],[16,1,18,1],[16,2,18,2],[16,3,18,3],[16,4,18,4],[3,5,3,8],[5,1,6,1],[5,2,6,2],[5,3,6,3],[5,4,6,4],[13,2,15,2],[13,3,15,3],[19,1,21,1],[19,2,21,2],[19,3,21,3],[22,1,24,1],[22,2,24,2],[22,3,24,3],[37,3,39,3],[34,1,36,1],[34,2,36,2],[34,3,36,3],[49,4,51,4],[49,1,51,1],[49,2,51,2],[49,3,51,3],[46,1,48,1],[46,2,48,2],[46,3,48,3],[46,4,48,4],[52,4,54,4],[61,1,63,1],[61,2,63,2],[61,3,63,3],[61,4,63,4],[55,1,57,1],[55,2,57,2],[55,3,57,3],[55,4,57,4],[58,1,60,1],[58,2,60,2],[58,3,60,3],[58,4,60,4],[52,1,54,1],[52,2,54,2],[52,3,54,3]]}
[]
[]
[null,null,null,null,null,null,null,null,false]
[null,"Ref.","Key NCSA guidance","Category","Question","Answer"]
[null,null,null,null,null,null,"Only check 1"]
[null,{"$f":"'5. Answer reference sheet'!B5","v":"1\n(Intro)"},{"$f":"'5. Answer reference sheet'!C5","v":"N/A"},{"$f":"'5. Answer reference sheet'!D5","v":"Applicability of the PDPPL"},{"$f":"'5. Answer reference sheet'!E5","v":"Does your organisation process personal data electronically; collect, receive or mine personal data in anticipation of processing it electronically or process personal data through a combination of electronic and traditional processing techniques?\n\n*If you do not process any personal data, you will not need to complete the rest of this assessment or take action to comply with the PDPPL."},{"$f":"'5. Answer reference sheet'!H5","v":"A"},true,{"$f":"F6","v":"A"},{"$f":"'5. Answer reference sheet'!I5","v":"No"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H6","v":"B"},false,{"$f":"F7","v":"B"},{"$f":"'5. Answer reference sheet'!I6","v":"Yes"}]
[null,{"$f":"'5. Answer reference sheet'!B7","v":2},{"$f":"'5. Answer reference sheet'!C7","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D7","v":"Principles of Data Privacy"},{"$f":"'5. Answer reference sheet'!E7","v":"Does your organisation conduct regular audits to understand the processing of personal data that it undertakes?\n\n*These audits will help you understand how personal data flows across the organisation and how it is used."},{"$f":"'5. Answer reference sheet'!H7","v":"A"},false,{"$f":"F8","v":"A"},{"$f":"'5. Answer reference sheet'!I7","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H8","v":"B"},false,{"$f":"F9","v":"B"},{"$f":"'5. Answer reference sheet'!I8","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H9","v":"C"},false,{"$f":"F10","v":"C"},{"$f":"'5. Answer reference sheet'!I9","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B10","v":3},{"$f":"'5. Answer reference sheet'!C10","v":"- Register of Processing Activities (RoPA) Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D10","v":"Principles of Data Privacy"},{"$f":"'5. Answer reference sheet'!E10","v":"Does your organisation document what personal data of individuals (e.g. customers and/or employees) it processes in a RoPA?"},{"$f":"'5. Answer reference sheet'!H10","v":"A"},false,{"$f":"F11","v":"A"},{"$f":"'5. Answer reference sheet'!I10","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H11","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I11","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H12","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I12","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B13","v":4},{"$f":"'5. Answer reference sheet'!C13","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D13","v":"Permitted Reasons "},{"$f":"'5. Answer reference sheet'!E13","v":"Does your organisation have measures in place to identify and document the permitted reason for processing personal data?\n\n*Under the PDPPL there are four permitted reasons for processing, these are:\n- Explicit Consent: of the individual to the processing of personal data. \n- Contractual: processing is needed in order to enter into a contract.\n- Legal Obligation: for which the organisation is obliged to process data for.\n- Legitimate Interest: of the organisation or the third parties engaged."},{"$f":"'5. Answer reference sheet'!H13","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I13","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H14","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I14","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H15","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I15","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B16","v":5},{"$f":"'5. Answer reference sheet'!C16","v":"- Competent Authority Exemptions Guidelines for Regulated Entities\n\n- Controller Exemptions Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D16","v":"Exemptions"},{"$f":"'5. Answer reference sheet'!E16","v":"Does your organisation have measures in place to identify and document any exemptions under articles 18 and/or 19?"},{"$f":"'5. Answer reference sheet'!H16","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I16","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H17","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I17","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H18","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I18","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B19","v":6},{"$f":"'5. Answer reference sheet'!C19","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D19","v":"Permitted Reasons "},{"$f":"'5. Answer reference sheet'!E19","v":"Where 'Explicit Consent' is identified as the permitted reason for processing, does your organisation have an established process for asking and recording consent?"},{"$f":"'5. Answer reference sheet'!H19","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I19","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H20","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I20","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H21","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I21","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B22","v":7},{"$f":"'5. Answer reference sheet'!C22","v":"- Special Nature Processing Guidelines for Regulated Entities "},{"$f":"'5. Answer reference sheet'!D22","v":"Special Nature Processing"},{"$f":"'5. Answer reference sheet'!E22","v":"Does your organisation comply with the requirements for processing 'personal data of special nature?'\n\n*Under the PDPPL 'personal data of a special nature' is:\n- Ethnic origin (race)\n- Children \n- Health, physical or psychological condition\n- Religion\n- Marital relations \n- Criminal offences\n- Biometrics"},{"$f":"'5. Answer reference sheet'!H22","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I22","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H23","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I23","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H24","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I24","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B25","v":8},{"$f":"'5. Answer reference sheet'!C25","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D25","v":"Permitted Reasons"},{"$f":"'5. Answer reference sheet'!E25","v":"Where 'Legitimate Interests' is identified as the permitted reason for processing, have you carried out an LIA (Legitimate Interests Assessment) in accordance with the NCSA guidelines?"},{"$f":"'5. Answer reference sheet'!H25","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I25","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H26","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I26","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H27","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I27","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B28","v":9},{"$f":"'5. Answer reference sheet'!C28","v":"- Individuals’ Rights Guidelines for Regulated Entities\n\n- Individuals’ Rights Guidelines for Individuals"},{"$f":"'5. Answer reference sheet'!D28","v":"Individuals' Rights"},{"$f":"'5. Answer reference sheet'!E28","v":"Does your organisation have the procedures in place to enable individuals to exercise their rights as set out in the PDPPL?\n\n*These are as follows:\nthe right to protection and lawful processing;\nthe right to withdraw consent;\nthe right to object to processing in certain circumstances;\nthe right to erasure;\nthe right to request correction;\nthe right to be notified of processing; \nthe right to be notified of inaccurate disclosure; and\nthe right to access their personal data."},{"$f":"'5. Answer reference sheet'!H28","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I28","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H29","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I29","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H30","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I30","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B31","v":10},{"$f":"'5. Answer reference sheet'!C31","v":"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n*Items contained within the Checklist refer to further guidelines which contain full requirements "},{"$f":"'5. Answer reference sheet'!D31","v":"Governance"},{"$f":"'5. Answer reference sheet'!E31","v":"Does your organisation have clearly defined, approved and communicated policies relating to the processing of personal data and is compliance monitored across the organisation?"},{"$f":"'5. Answer reference sheet'!H31","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I31","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H32","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I32","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H33","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I33","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B34","v":11},{"$f":"'5. Answer reference sheet'!C34","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D34","v":"Governance"},{"$f":"'5. Answer reference sheet'!E34","v":"Does your organisation have a governance framework that clearly sets out roles & responsibilities in relation to data privacy?"},{"$f":"'5. Answer reference sheet'!H34","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I34","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H35","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I35","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H36","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I36","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B37","v":12},{"$f":"'5. Answer reference sheet'!C37","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D37","v":"Training and awareness"},{"$f":"'5. Answer reference sheet'!E37","v":"Does your organisation have a procedure in place to ensure Data Privacy training and awareness is being conducted across the organisation?"},{"$f":"'5. Answer reference sheet'!H37","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I37","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H38","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I38","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H39","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I39","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B40","v":13},{"$f":"'5. Answer reference sheet'!C40","v":"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n- Controller and Processor Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D40","v":"Third party agreements"},{"$f":"'5. Answer reference sheet'!E40","v":"Does your organisation have a written contract with processors who process personal data on your behalf, including requirements for the use of sub processors?"},{"$f":"'5. Answer reference sheet'!H40","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I40","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H41","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I41","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H42","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I42","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B43","v":14},{"$f":"'5. Answer reference sheet'!C43","v":"- Data Privacy Impact Assessment (DPIA) Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D43","v":"Data Privacy Impact Assessment (DPIA)"},{"$f":"'5. Answer reference sheet'!E43","v":"Is there a formal, documented framework to conduct and manage Data Privacy Impact Assessments (DPIAs) across the organisation?\n\n* A DPIA is an assessment to identify the risk of processing personal data to individuals and  mitigate the risk of processing to an acceptable level. It is similar to a risk assessment, and should be performed consistently in a standardised manner across the organisation."},{"$f":"'5. Answer reference sheet'!H43","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I43","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H44","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I44","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H45","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I45","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B46","v":15},{"$f":"'5. Answer reference sheet'!C46","v":"- Cross-Border Data flows Permit Request Form for Regulated Entities (English)"},{"$f":"'5. Answer reference sheet'!D46","v":"Cross border data flows"},{"$f":"'5. Answer reference sheet'!E46","v":"Does your organisation ensure an adequate level of protection for any personal data processed by others on your behalf that is transferred outside the state of Qatar?"},{"$f":"'5. Answer reference sheet'!H46","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I46","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H47","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I47","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H48","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I48","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B49","v":16},{"$f":"'5. Answer reference sheet'!C49","v":"- Personal Data Breach Notifications Guidelines for Regulated Entities "},{"$f":"'5. Answer reference sheet'!D49","v":"Data breaches"},{"$f":"'5. Answer reference sheet'!E49","v":"Does your organisation have a formal, documented process to identify and respond to privacy related incidents and breaches?"},{"$f":"'5. Answer reference sheet'!H49","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I49","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H50","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I50","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H51","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I51","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B52","v":17},{"$f":"'5. Answer reference sheet'!C52","v":"- Data Privacy by Design and by Default Guidelines"},{"$f":"'5. Answer reference sheet'!D52","v":"Privacy by design"},{"$f":"'5. Answer reference sheet'!E52","v":"Is there a framework in place to embed data privacy by design and default within the organisation?"},{"$f":"'5. Answer reference sheet'!H52","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I52","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H53","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I53","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H54","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I54","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B55","v":18},{"$f":"'5. Answer reference sheet'!C55","v":"- Data Privacy by Design and by Default Guidelines"},{"$f":"'5. Answer reference sheet'!D55","v":"Security"},{"$f":"'5. Answer reference sheet'!E55","v":"Does your organisation implement appropriate administrative, technical and financial precautions in compliance with PDPPL requirements?"},{"$f":"'5. Answer reference sheet'!H55","v":"A"},false,{"$f":"F56","v":"A"},{"$f":"'5. Answer reference sheet'!I55","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H56","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I56","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H57","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I57","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B58","v":19},{"$f":"'5. Answer reference sheet'!C58","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'5. Answer reference sheet'!D58","v":"Children's websites"},{"$f":"'5. Answer reference sheet'!E58","v":"Does your organisation take account of the PDPPL requirements for owners or operators of websites directed at children?"},{"$f":"'5. Answer reference sheet'!H58","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I58","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H59","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I59","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H60","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I60","v":"No - Not Applicable"}]
[null,{"$f":"'5. Answer reference sheet'!B61","v":20},{"$f":"'5. Answer reference sheet'!C61","v":"- Complaints Guidelines for Regulated Entities\n\n- Complaints Guidelines for Individuals"},{"$f":"'5. Answer reference sheet'!D61","v":"Complaints"},{"$f":"'5. Answer reference sheet'!E61","v":"Does your organisation have a system in place to ensure individuals are able to raise concerns or complaints to the organisation?"},{"$f":"'5. Answer reference sheet'!H61","v":"A"},false,"A",{"$f":"'5. Answer reference sheet'!I61","v":"No - Not yet completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H62","v":"B"},false,"B",{"$f":"'5. Answer reference sheet'!I62","v":"Yes - Successfully completed"}]
[null,null,null,null,null,{"$f":"'5. Answer reference sheet'!H63","v":"C"},false,"C",{"$f":"'5. Answer reference sheet'!I63","v":"No - Not Applicable"}]

{"sheet":"4. Summary report","index":3,"n_rows":30,"n_cols":11,"rows_kept":30,"cut":false,"hidden":false,"merged":[[20,7,20,8],[21,7,21,8],[22,7,22,8],[23,7,23,8],[24,7,24,8],[18,7,18,8],[19,7,19,8],[1,6,1,10],[3,10,5,10],[8,6,8,8],[9,6,9,8],[10,7,10,8],[11,7,11,8],[12,7,12,8],[13,7,13,8],[14,7,14,8],[15,7,15,8],[16,7,16,8],[17,7,17,8],[25,7,25,8],[26,7,26,8],[27,7,27,8],[28,7,28,8],[29,7,29,8]]}
[]
[null,null,null,null,null,null,"Report Dashboard"]
[null,null,null,null,null,null,"Ref.","Definition","Number of Response",null,"Overall Rating"]
[null,null,null,null,null,null,"A","Not yet completed",{"$f":"COUNTIF($G$11:$G$30,\"A\")","v":1},{"$f":"I4/K7","v":0.05},{"$f":"_xlfn.IFS(J5>0.67,\"Green\", 0.33>J5, \"Red\", 0.67>J5,\"Amber\")","v":"Red"}]
[null,null,null,null,null,null,"B","Successfully completed",{"$f":"COUNTIF($G$11:$G$30,\"B\")","v":0},{"$f":"I5/K7","v":0}]
[null,null,null,null,null,null,"C","N/A",{"$f":"COUNTIF($G$11:$G$30,\"C\")","v":0}]
[null,null,null,null,null,null,null,null,null,{"$f":"SUM(J4:J5)","v":0.05},{"$f":"20-I6","v":20}]
[]
[null,"Ref.","Relevant NCSA guidance","Category","Question","CONCAT","Your Answer",null,null,null,"Initial Considerations"]
[]
[null,{"$f":"'3. Data Protection Self-Assessm'!B6","v":"1\n(Intro)"},{"$f":"'3. Data Protection Self-Assessm'!C6","v":"N/A"},{"$f":"'3. Data Protection Self-Assessm'!D6","v":"Applicability of the PDPPL"},{"$f":"'3. Data Protection Self-Assessm'!E6","v":"Does your organisation process personal data electronically; collect, receive or mine personal data in anticipation of processing it electronically or process personal data through a combination of electronic and traditional processing techniques?\n\n*If you do not process any personal data, you will not need to complete the rest of this assessment or take action to comply with the PDPPL."},{"$f":"CONCATENATE(B11,G11)","v":"1\n(Intro)A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G6:H7,2,FALSE)","v":"A"},{"$f":"VLOOKUP(G11,$G$4:$H$6,2,FALSE)","v":"Not yet completed"},null,null,{"$f":"VLOOKUP(F11,'5. Answer reference sheet'!G5:J6,4,TRUE)","v":"o Organisation's processing is not captured within the scope of the PDPPL and does not need to take action to comply."}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B8","v":2},{"$f":"'3. Data Protection Self-Assessm'!C8","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D8","v":"Principles of Data Privacy"},{"$f":"'3. Data Protection Self-Assessm'!E8","v":"Does your organisation conduct regular audits to understand the processing of personal data that it undertakes?\n\n*These audits will help you understand how personal data flows across the organisation and how it is used."},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G8:H10,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F12,'5. Answer reference sheet'!G7:J9,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B11","v":3},{"$f":"'3. Data Protection Self-Assessm'!C11","v":"- Register of Processing Activities (RoPA) Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D11","v":"Principles of Data Privacy"},{"$f":"'3. Data Protection Self-Assessm'!E11","v":"Does your organisation document what personal data of individuals (e.g. customers and/or employees) it processes in a RoPA?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G11:H13,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F13,'5. Answer reference sheet'!G10:J12,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B14","v":4},{"$f":"'3. Data Protection Self-Assessm'!C14","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D14","v":"Permitted Reasons "},{"$f":"'3. Data Protection Self-Assessm'!E14","v":"Does your organisation have measures in place to identify and document the permitted reason for processing personal data?\n\n*Under the PDPPL there are four permitted reasons for processing, these are:\n- Explicit Consent: of the individual to the processing of personal data. \n- Contractual: processing is needed in order to enter into a contract.\n- Legal Obligation: for which the organisation is obliged to process data for.\n- Legitimate Interest: of the organisation or the third parties engaged."},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G14:H16,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F14,'5. Answer reference sheet'!G13:J15,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B17","v":5},{"$f":"'3. Data Protection Self-Assessm'!C17","v":"- Competent Authority Exemptions Guidelines for Regulated Entities\n\n- Controller Exemptions Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D17","v":"Exemptions"},{"$f":"'3. Data Protection Self-Assessm'!E17","v":"Does your organisation have measures in place to identify and document any exemptions under articles 18 and/or 19?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G17:H19,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F15,'5. Answer reference sheet'!G16:J18,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B20","v":6},{"$f":"'3. Data Protection Self-Assessm'!C20","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D20","v":"Permitted Reasons "},{"$f":"'3. Data Protection Self-Assessm'!E20","v":"Where 'Explicit Consent' is identified as the permitted reason for processing, does your organisation have an established process for asking and recording consent?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G20:H22,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F16,'5. Answer reference sheet'!G19:J21,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B23","v":7},{"$f":"'3. Data Protection Self-Assessm'!C23","v":"- Special Nature Processing Guidelines for Regulated Entities "},{"$f":"'3. Data Protection Self-Assessm'!D23","v":"Special Nature Processing"},{"$f":"'3. Data Protection Self-Assessm'!E23","v":"Does your organisation comply with the requirements for processing 'personal data of special nature?'\n\n*Under the PDPPL 'personal data of a special nature' is:\n- Ethnic origin (race)\n- Children \n- Health, physical or psychological condition\n- Religion\n- Marital relations \n- Criminal offences\n- Biometrics"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G23:H25,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F17,'5. Answer reference sheet'!G22:J24,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B26","v":8},{"$f":"'3. Data Protection Self-Assessm'!C26","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D26","v":"Permitted Reasons"},{"$f":"'3. Data Protection Self-Assessm'!E26","v":"Where 'Legitimate Interests' is identified as the permitted reason for processing, have you carried out an LIA (Legitimate Interests Assessment) in accordance with the NCSA guidelines?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G26:H28,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F18,'5. Answer reference sheet'!G25:J27,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B29","v":9},{"$f":"'3. Data Protection Self-Assessm'!C29","v":"- Individuals’ Rights Guidelines for Regulated Entities\n\n- Individuals’ Rights Guidelines for Individuals"},{"$f":"'3. Data Protection Self-Assessm'!D29","v":"Individuals' Rights"},{"$f":"'3. Data Protection Self-Assessm'!E29","v":"Does your organisation have the procedures in place to enable individuals to exercise their rights as set out in the PDPPL?\n\n*These are as follows:\nthe right to protection and lawful processing;\nthe right to withdraw consent;\nthe right to object to processing in certain circumstances;\nthe right to erasure;\nthe right to request correction;\nthe right to be notified of processing; \nthe right to be notified of inaccurate disclosure; and\nthe right to access their personal data."},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G29:H31,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F19,'5. Answer reference sheet'!G28:J30,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B32","v":10},{"$f":"'3. Data Protection Self-Assessm'!C32","v":"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n*Items contained within the Checklist refer to further guidelines which contain full requirements "},{"$f":"'3. Data Protection Self-Assessm'!D32","v":"Governance"},{"$f":"'3. Data Protection Self-Assessm'!E32","v":"Does your organisation have clearly defined, approved and communicated policies relating to the processing of personal data and is compliance monitored across the organisation?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G32:H34,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F20,'5. Answer reference sheet'!G31:J33,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B35","v":11},{"$f":"'3. Data Protection Self-Assessm'!C35","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D35","v":"Governance"},{"$f":"'3. Data Protection Self-Assessm'!E35","v":"Does your organisation have a governance framework that clearly sets out roles & responsibilities in relation to data privacy?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G35:H37,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F21,'5. Answer reference sheet'!G34:J36,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B38","v":12},{"$f":"'3. Data Protection Self-Assessm'!C38","v":"- Principles of Data Privacy Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D38","v":"Training and awareness"},{"$f":"'3. Data Protection Self-Assessm'!E38","v":"Does your organisation have a procedure in place to ensure Data Privacy training and awareness is being conducted across the organisation?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G38:H40,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F22,'5. Answer reference sheet'!G37:J39,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B41","v":13},{"$f":"'3. Data Protection Self-Assessm'!C41","v":"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n- Controller and Processor Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D41","v":"Third party agreements"},{"$f":"'3. Data Protection Self-Assessm'!E41","v":"Does your organisation have a written contract with processors who process personal data on your behalf, including requirements for the use of sub processors?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G41:H43,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F23,'5. Answer reference sheet'!G40:J42,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B44","v":14},{"$f":"'3. Data Protection Self-Assessm'!C44","v":"- Data Privacy Impact Assessment (DPIA) Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D44","v":"Data Privacy Impact Assessment (DPIA)"},{"$f":"'3. Data Protection Self-Assessm'!E44","v":"Is there a formal, documented framework to conduct and manage Data Privacy Impact Assessments (DPIAs) across the organisation?\n\n* A DPIA is an assessment to identify the risk of processing personal data to individuals and  mitigate the risk of processing to an acceptable level. It is similar to a risk assessment, and should be performed consistently in a standardised manner across the organisation."},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G44:H46,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F24,'5. Answer reference sheet'!G43:J45,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B47","v":15},{"$f":"'3. Data Protection Self-Assessm'!C47","v":"- Cross-Border Data flows Permit Request Form for Regulated Entities (English)"},{"$f":"'3. Data Protection Self-Assessm'!D47","v":"Cross border data flows"},{"$f":"'3. Data Protection Self-Assessm'!E47","v":"Does your organisation ensure an adequate level of protection for any personal data processed by others on your behalf that is transferred outside the state of Qatar?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G47:H49,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F25,'5. Answer reference sheet'!G46:J48,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B50","v":16},{"$f":"'3. Data Protection Self-Assessm'!C50","v":"- Personal Data Breach Notifications Guidelines for Regulated Entities "},{"$f":"'3. Data Protection Self-Assessm'!D50","v":"Data breaches"},{"$f":"'3. Data Protection Self-Assessm'!E50","v":"Does your organisation have a formal, documented process to identify and respond to privacy related incidents and breaches?"},{"$f":"CONCATENATE(B26,G26)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G50:H52,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F26,'5. Answer reference sheet'!G49:J51,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B53","v":17},{"$f":"'3. Data Protection Self-Assessm'!C53","v":"- Data Privacy by Design and by Default Guidelines"},{"$f":"'3. Data Protection Self-Assessm'!D53","v":"Privacy by design"},{"$f":"'3. Data Protection Self-Assessm'!E53","v":"Is there a framework in place to embed data privacy by design and default within the organisation?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G53:H55,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F27,'5. Answer reference sheet'!G52:J54,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B56","v":18},{"$f":"'3. Data Protection Self-Assessm'!C56","v":"- Data Privacy by Design and by Default Guidelines"},{"$f":"'3. Data Protection Self-Assessm'!D56","v":"Security"},{"$f":"'3. Data Protection Self-Assessm'!E56","v":"Does your organisation implement appropriate administrative, technical and financial precautions in compliance with PDPPL requirements?"},{"$f":"CONCATENATE(B28,G28)","v":{"$error":"#N/A"}},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G56:H58,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F28,'5. Answer reference sheet'!G55:J57,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B59","v":19},{"$f":"'3. Data Protection Self-Assessm'!C59","v":"- Permitted Reasons Guidelines for Regulated Entities"},{"$f":"'3. Data Protection Self-Assessm'!D59","v":"Children's websites"},{"$f":"'3. Data Protection Self-Assessm'!E59","v":"Does your organisation take account of the PDPPL requirements for owners or operators of websites directed at children?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G59:H61,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F29,'5. Answer reference sheet'!G58:J60,4,TRUE)","v":{"$error":"#N/A"}}]
[null,{"$f":"'3. Data Protection Self-Assessm'!B62","v":20},{"$f":"'3. Data Protection Self-Assessm'!C62","v":"- Complaints Guidelines for Regulated Entities\n\n- Complaints Guidelines for Individuals"},{"$f":"'3. Data Protection Self-Assessm'!D62","v":"Complaints"},{"$f":"'3. Data Protection Self-Assessm'!E62","v":"Does your organisation have a system in place to ensure individuals are able to raise concerns or complaints to the organisation?"},{"$error":"#N/A"},{"$f":"VLOOKUP(TRUE,'3. Data Protection Self-Assessm'!G62:H64,2,FALSE)","v":{"$error":"#N/A"}},{"$error":"#N/A"},null,null,{"$f":"VLOOKUP(F30,'5. Answer reference sheet'!G61:J63,4,TRUE)","v":{"$error":"#N/A"}}]

{"sheet":"5. Answer reference sheet","index":4,"n_rows":63,"n_cols":10,"rows_kept":63,"cut":false,"hidden":true,"merged":[[36,4,38,4],[30,1,32,1],[33,1,35,1],[33,2,35,2],[33,3,35,3],[33,4,35,4],[36,1,38,1],[30,4,32,4],[30,2,32,2],[30,3,32,3],[36,2,38,2],[36,3,38,3],[39,1,41,1],[39,2,41,2],[39,3,41,3],[39,4,41,4],[42,1,44,1],[42,2,44,2],[42,3,44,3],[42,4,44,4],[45,1,47,1],[45,2,47,2],[45,3,47,3],[45,4,47,4],[51,1,53,1],[51,2,53,2],[51,3,53,3],[48,4,50,4],[51,4,53,4],[48,1,50,1],[48,2,50,2],[48,3,50,3],[2,7,2,8],[6,1,8,1],[6,2,8,2],[6,3,8,3],[6,4,8,4],[4,1,5,1],[4,2,5,2],[4,3,5,3],[4,4,5,4],[3,7,3,8],[24,4,26,4],[27,4,29,4],[9,1,11,1],[9,2,11,2],[9,3,11,3],[15,1,17,1],[15,2,17,2],[15,3,17,3],[12,1,14,1],[12,2,14,2],[12,3,14,3],[9,4,11,4],[15,4,17,4],[18,4,20,4],[12,4,14,4],[18,1,20,1],[21,1,23,1],[21,2,23,2],[21,3,23,3],[21,4,23,4],[18,2,20,2],[18,3,20,3],[24,1,26,1],[24,2,26,2],[24,3,26,3],[27,1,29,1],[27,2,29,2],[27,3,29,3],[60,1,62,1],[60,2,62,2],[60,3,62,3],[60,4,62,4],[54,1,56,1],[54,2,56,2],[54,3,56,3],[54,4,56,4],[57,1,59,1],[57,2,59,2],[57,3,59,3],[57,4,59,4]]}
[]
[]
[null,"Ref.","Key NCSA Guidance","Category","Question","Hidden Ref.","CONCAT","Your Answer",null,"Initial Considerations"]
[]
[null,"1\n(Intro)","N/A","Applicability of the PDPPL","Does your organisation process personal data electronically; collect, receive or mine personal data in anticipation of processing it electronically or process personal data through a combination of electronic and traditional processing techniques?\n\n*If you do not process any personal data, you will not need to complete the rest of this assessment or take action to comply with the PDPPL.",{"$f":"B5","v":"1\n(Intro)"},{"$f":"CONCATENATE(F5,H5)","v":"1\n(Intro)A"},"A","No","o Organisation's processing is not captured within the scope of the PDPPL and does not need to take action to comply."]
[null,null,null,null,null,{"$f":"B5","v":"1\n(Intro)"},"1\n(Intro)B","B","Yes","o Organisation's processing is captured within the scope of the PDPPL and must take action to comply."]
[null,2,"- Principles of Data Privacy Guidelines for Regulated Entities","Principles of Data Privacy","Does your organisation conduct regular audits to understand the processing of personal data that it undertakes?\n\n*These audits will help you understand how personal data flows across the organisation and how it is used.",{"$f":"B7","v":2},{"$f":"CONCATENATE(F7,H7)","v":"2A"},"A","No - Not yet completed","o Plan an audit schedule across your orgnaisation to document and understand how personal information flows throughout your organisation.\no Document and plan remediation of any risks identified as part of the audit."]
[null,null,null,null,null,{"$f":"B7","v":2},"2B","B","Yes - Successfully completed","o Continue conducting periodic audits. These audits should take into consideration different aspects of the data privacy programme including all relevant stakeholders.\no Ensure this is conducted by a person with extensive knowledge of your organisation."]
[null,null,null,null,null,{"$f":"B7","v":2},"2C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,3,"- Register of Processing Activities (RoPA) Guidelines for Regulated Entities","Principles of Data Privacy","Does your organisation document what personal data of individuals (e.g. customers and/or employees) it processes in a RoPA?",{"$f":"B10","v":3},"3A","A","No - Not yet completed","o Establish a RoPA register that maintains records of processing activities in accordance with the NCSA published guidelines."]
[null,null,null,null,null,{"$f":"B10","v":3},"3B","B","Yes - Successfully completed","o  Review the RoPA in accordance with the NCSA-published guidelines to ensure that the existing RoPA is collecting all information required.\no Monitor the RoPA to ensure that information documented within is relevant and up-to-date and keep under review."]
[null,null,null,null,null,{"$f":"B10","v":3},"3C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,4,"- Permitted Reasons Guidelines for Regulated Entities","Permitted Reasons ","Does your organisation have measures in place to identify and document the permitted reason for processing personal data?\n\n*Under the PDPPL there are four permitted reasons for processing, these are:\n- Explicit Consent: of the individual to the processing of personal data. \n- Contractual: processing is needed in order to enter into a contract.\n- Legal Obligation: for which the organisation is obliged to process data for.\n- Legitimate Interest: of the organisation or the third parties engaged.",{"$f":"B13","v":4},{"$f":"CONCATENATE(F13,H13)","v":"4A"},"A","No - Not yet completed","o Establish measures to identify and document the permitted reasons for processing prior to processing personal data across the organisation."]
[null,null,null,null,null,{"$f":"B13","v":4},"4B","B","Yes - Successfully completed","o Ensure that the documented permitted reasons for processing identified are accurate. \nN.B. No single reason is better or more important than the others. Depending on the purpose for processing and the relationship with the individual you will be able to identify the most appropriate permitted reason for processing personal data."]
[null,null,null,null,null,{"$f":"B13","v":4},"4C","C","No - Not Applicable","o Document exemptions from identifying a permitted reason for processing personal data were relevant in accordance with relevant NCSA published guidelines.\nN.B. Exemptions from Article 4 are available to Controllers under Article 18 in certain circumstances."]
[null,5,"- Competent Authority Exemptions Guidelines for Regulated Entities\n\n- Controller Exemptions Guidelines for Regulated Entities","Exemptions","Does your organisation have measures in place to identify and document any exemptions under articles 18 and/or 19?",{"$f":"B16","v":5},"5A","A","No - Not yet completed","o Establish measures to identify and document the exemptions from certain PDPPL requirements under Article 18 and/or 19 prior to processing personal data across the organisation."]
[null,null,null,null,null,{"$f":"B16","v":5},"5B","B","Yes - Successfully completed","o Ensure that the documented exemptions under Article 18 and/or 19 already identified are accurate and keep under continuous review.\no Maintain a special record of such exemptions if the organisation is a Competent Authority relying on exemptions under Article 19.\nN.B. Article 19 requires Competent Authorities to document and maintain a special record of such exemptions."]
[null,null,null,null,null,{"$f":"B16","v":5},"5C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,6,"- Permitted Reasons Guidelines for Regulated Entities","Permitted Reasons ","Where 'Explicit Consent' is identified as the permitted reason for processing, does your organisation have an established process for asking and recording consent?",{"$f":"B19","v":6},"6A","A","No - Not yet completed","o Document processes that are reliant on Explicit Consent as a permitted reasons of processing.\no Check that consent is the most appropriate permitted reasons for processing.\no Comply with the NCSA published guidelines and PDPPL requirements which include the following:\n   - Specify reasons for processing and how the personal data will be processed.\n   - Document any third party organisations that are relevant to this consent.\n   - Allow options to allow individuals to consent separately to different types of processing wherever appropriate.\n   - Communicate to individuals that they are able to withdraw consent at any time and clarify how this is done."]
[null,null,null,null,null,{"$f":"B19","v":6},"6B","B","Yes - Successfully completed","o Monitor processes that are relying on consent as a permitted reason for processing and keep under review"]
[null,null,null,null,null,{"$f":"B19","v":6},"6C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,7,"- Special Nature Processing Guidelines for Regulated Entities ","Special Nature Processing","Does your organisation comply with the requirements for processing 'personal data of special nature?'\n\n*Under the PDPPL 'personal data of a special nature' is:\n- Ethnic origin (race)\n- Children \n- Health, physical or psychological condition\n- Religion\n- Marital relations \n- Criminal offences\n- Biometrics",{"$f":"B22","v":7},"7A","A","No - Not yet completed","o Identify and document all personal data of a special nature that is processed.\no Identify and document permitted reasons for processing personal data of a special nature, or exemption from this requirement.\no Identify and document additional condition for each activity that involves the processing of personal data of a special nature.\no Carry out a Data Protection Impact Assessment (DPIA) on activities that involve the processing of personal data of a special nature.\no Obtain permission from the NCSA to carry out processing activities that involve the processing of personal data of a special nature."]
[null,null,null,null,null,{"$f":"B22","v":7},"7B","B","Yes - Successfully completed","o Monitor requirements for  'personal data of a special nature' and keep under review."]
[null,null,null,null,null,{"$f":"B22","v":7},"7C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,8,"- Permitted Reasons Guidelines for Regulated Entities","Permitted Reasons","Where 'Legitimate Interests' is identified as the permitted reason for processing, have you carried out an LIA (Legitimate Interests Assessment) in accordance with the NCSA guidelines?",{"$f":"B25","v":8},"8A","A","No - Not yet completed","o Document processes that rely on legitimate interest as a permitted reason for processing personal data and carry out such assessments.\no Check that legitimate interest is the most appropriate permitted reasons for processing."]
[null,null,null,null,null,{"$f":"B25","v":8},"8B","B","Yes - Successfully completed","o Ensure that the process that you have in place encompasses all requirements as provided by the NCSA published guidelines for carrying out LIAs."]
[null,null,null,null,null,{"$f":"B25","v":8},"8C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,9,"- Individuals’ Rights Guidelines for Regulated Entities\n\n- Individuals’ Rights Guidelines for Individuals","Individuals' Rights","Does your organisation have the procedures in place to enable individuals to exercise their rights as set out in the PDPPL?\n\n*These are as follows:\nthe right to protection and lawful processing;\nthe right to withdraw consent;\nthe right to object to processing in certain circumstances;\nthe right to erasure;\nthe right to request correction;\nthe right to be notified of processing; \nthe right to be notified of inaccurate disclosure; and\nthe right to access their personal data.",{"$f":"B28","v":9},"9A","A","No - Not yet completed","o Establish measures to enable individuals to exercise each of their rights over their personal data that is processed. For more information on the requirements, please refer to the NCSA published guidelines."]
[null,null,null,null,null,{"$f":"B28","v":9},"9B","B","Yes - Successfully completed","o Maintain measures to enable individuals to exercise each of their rights over their personal data that is processed and keep under review. For more information on the requirements, please refer to the NCSA published guidelines."]
[null,null,null,null,null,{"$f":"B28","v":9},"9C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,10,"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n*Items contained within the Checklist refer to further guidelines which contain full requirements ","Governance","Does your organisation have clearly defined, approved and communicated policies relating to the processing of personal data and is compliance monitored across the organisation?",{"$f":"B31","v":10},"10A","A","No - Not yet completed","o Establish a policy framework and implement component policies to comply with the PDPPL requirements.\no Ensure policies are properly defined and contain concise and clear information."]
[null,null,null,null,null,{"$f":"B31","v":10},"10B","B","Yes - Successfully completed","o Monitor existing documents and policies in place pertaining to processing personal data and keep under review.\no Ensure these are being communicated across the organisation."]
[null,null,null,null,null,{"$f":"B31","v":10},"10C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,11,"- Principles of Data Privacy Guidelines for Regulated Entities","Governance","Does your organisation have a governance framework that clearly sets out roles & responsibilities in relation to data privacy?",{"$f":"B34","v":11},"11A","A","No - Not yet completed","o Develop an efficient governance model across the organisation that encompasses all relevant stakeholders. This model should take into consideration different key dimensions of the organisation including People, Process and Technology."]
[null,null,null,null,null,{"$f":"B34","v":11},"11B","B","Yes - Successfully completed","o Review the existing governance model in place and ensure that it encompasses all Data Privacy mandates as required by the PDPPL. "]
[null,null,null,null,null,{"$f":"B34","v":11},"11C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,12,"- Principles of Data Privacy Guidelines for Regulated Entities","Training and awareness","Does your organisation have a procedure in place to ensure Data Privacy training and awareness is being conducted across the organisation?",{"$f":"B37","v":12},"12A","A","No - Not yet completed","o Develop a training & awareness programme in relation to Data Privacy and ensure it is being conducted and updated on a periodic basis."]
[null,null,null,null,null,{"$f":"B37","v":12},"12B","B","Yes - Successfully completed","o Ensure that training programme being developed provides general and role-specific privacy and security training to all employees.\no Monitor and track training & awareness programme and escalate when necessary. It is recommended that the privacy and security training content is reviewed and updated on an annual basis or as otherwise needed by the appropriate personnel."]
[null,null,null,null,null,{"$f":"B37","v":12},"12C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,13,"- Personal Data Management System (PDMS) Checklist for Regulated Entities\n\n- Controller and Processor Guidelines for Regulated Entities","Third party agreements","Does your organisation have a written contract with processors who process personal data on your behalf, including requirements for the use of sub processors?",{"$f":"B40","v":13},"13A","A","No - Not yet completed","o Review all processing activities to identify third party processors, and sub processors (if any).\no Ensure a written contract is in place with each third party processor and is in compliance with the PDPPL requirements.\no Ensure compliance requirements around sub processors have been met in accordance with the PDPPL. "]
[null,null,null,null,null,{"$f":"B40","v":13},"13B","B","Yes - Successfully completed","o Review all existing contracts in place with third party processors to ensure they are in compliance with the PDPPL requirements."]
[null,null,null,null,null,{"$f":"B40","v":13},"13C","C","No - Not Applicable","o Document reasoning as to why This is Not Applicable. If unsure about applicability, please visit the CGAA website and Review relevant published guidelines."]
[null,14,"- Data Privacy Impact Assessment (DPIA) Guidelines for Regulated Entities","Data Privacy Impact Assessment (DPIA)","Is there a formal, documented framework to conduct and manage Data Privacy Impact Assessments (DPIAs) across the organisation?\n\n* A DPIA is an assessment to identify the risk of processing personal data to individuals and  mitigate the risk of processing to an acceptable level. It is similar to a risk assessment, and should be performed consistently in a standardised manner across the organisation.",{"$f":"B43","v":14},"14A","A","No - Not yet completed","o Develop a framework to conduct Data Privacy Impact Assessments (DPIAs), including responsibilities and accountabilities in compliance with the PDPPL requirements. Please refer to the NCSA published guidelines for more information on how to conduct a DPIA."]
[null,null,null,null,null,{"$f":"B43","v":14},"14B","B","Yes - Successfully completed","o Ensure that DPIAs being undertaken meet PDPPL requirements as advised within the NCSA published guidelines.\no Ensure that a DPIA is triggered at all relevant times including but not limited to:\n   - Technology implementations or upgrades; \n   - Changes to existing processes; and \n   - Changes to products or services."]
[null,null,null,null,null,{"$f":"B43","v":14},"14C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,15,"- Cross-Border Data flows Permit Request Form for Regulated Entities (English)","Cross border data flows","Does your organisation ensure an adequate level of protection for any personal data processed by others on your behalf that is transferred outside the state of Qatar?",{"$f":"B46","v":15},"15A","A","No - Not yet completed","o Review all processing activities to identify activities that include the transfer of personal data outside the state of Qatar.\no Ensure adequate levels of protection to safeguard such transfers in compliance with PDPPL requirements. For more information on cross border data flows, please refer to the NCSA published guidelines."]
[null,null,null,null,null,{"$f":"B46","v":15},"15B","B","Yes - Successfully completed","o Monitor requirements for adequate safeguards of the transfer of personal data outside the state of Qatar and keep under review."]
[null,null,null,null,null,{"$f":"B46","v":15},"15C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,16,"- Personal Data Breach Notifications Guidelines for Regulated Entities ","Data breaches","Does your organisation have a formal, documented process to identify and respond to privacy related incidents and breaches?",{"$f":"B49","v":16},"16A","A","No - Not yet completed","o Develop and document a formal process that will allow staff across the organisation to recognise and report breaches as soon as they are aware of them in compliance with the PDPPL requirements."]
[null,null,null,null,null,{"$f":"B49","v":16},"16B","B","Yes - Successfully completed","o Monitor the incidents risks, type, frequency and cost to allow for more efficient planning and reduce occurrences through lessons learned and keep under review. For more information on data breaches, please refer to the NCSA published guidelines."]
[null,null,null,null,null,{"$f":"B49","v":16},"16C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,17,"- Data Privacy by Design and by Default Guidelines","Privacy by design","Is there a framework in place to embed data privacy by design and default within the organisation?",{"$f":"B52","v":17},"17A","A","No - Not yet completed","o Develop a framework to ensure that the organisation is able to embed data privacy by design and default when making decisions relating to and processing personal data."]
[null,null,null,null,null,{"$f":"B52","v":17},"17B","B","Yes - Successfully completed","o Ensure that all data privacy by design considerations are being reviewed on an ongoing basis to ensure that appropriate measures are continuously improved."]
[null,null,null,null,null,{"$f":"B52","v":17},"17C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,18,"- Data Privacy by Design and by Default Guidelines","Security","Does your organisation implement appropriate administrative, technical and financial precautions in compliance with PDPPL requirements?",{"$f":"B55","v":18},{"$f":"CONCATENATE(F55,H55)","v":"18A"},"A","No - Not yet completed","o Establish technical and physical security measures to protect personal data from loss, damage, modification, disclosure or being illegally or incidentally accessed or used in line with PDPPL requirements and Qatari international security policies and standards."]
[null,null,null,null,null,{"$f":"B55","v":18},"18B","B","Yes - Successfully completed","o Ensure compliance with PDPPL requirements and Qatari international security policies and standards."]
[null,null,null,null,null,{"$f":"B55","v":18},"18C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,19,"- Permitted Reasons Guidelines for Regulated Entities","Children's websites","Does your organisation take account of the PDPPL requirements for owners or operators of websites directed at children?",{"$f":"B58","v":19},{"$f":"CONCATENATE(F58,H58)","v":"19A"},"A","No - Not yet completed","o Implement the PDPPL requirements for owners or operators of websites directed at children which are:\n   - Posting a privacy notice for children.\n   - Obtaining explicit consent from the guardian of the child whose Personal Data is processed.\n   - Providing the child's guardian with a description of the Personal Data, the purpose for processing and a copy of the data processed or gathered about the child. \n   - Providing the child with the right to deletion, removal or suspension of processing of Personal Data upon the guardian's request. \n   - Ensuring that a child’s participation in a game, promotional award or any other activity is not conditional on the child's provision of Personal Data in excess of the necessary for the participation in such activity."]
[null,null,null,null,null,{"$f":"B58","v":19},"19B","B","Yes - Successfully completed","o Monitor compliance with requirements for owners and operators of websites directed at children and keep under review. For more information, please refer to the NCSA published guidelines on privacy notices and individuals' rights."]
[null,null,null,null,null,{"$f":"B58","v":19},"19C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]
[null,20,"- Complaints Guidelines for Regulated Entities\n\n- Complaints Guidelines for Individuals","Complaints","Does your organisation have a system in place to ensure individuals are able to raise concerns or complaints to the organisation?",{"$f":"B61","v":20},{"$f":"CONCATENATE(F61,H61)","v":"20A"},"A","No - Not yet completed","o Establish measures to handle complaints from individuals, have a process in place to facilitate this and determine the responsible contact to handle these complaints and respond within the required time frame."]
[null,null,null,null,null,{"$f":"B61","v":20},"20B","B","Yes - Successfully completed","o Monitor compliance with requirements for Individual complaints and keep under review."]
[null,null,null,null,null,{"$f":"B61","v":20},"20C","C","No - Not Applicable","o Document reasoning as to why this is Not Applicable. If unsure about applicability, please visit the CGAA website and review relevant published guidelines."]