{"text_format":"1","workbook":"xlsx","n_sheets":8,"sheets":["Sheet4","Report-Testing","ThankYou","Read this first","Initial Information Request","Assessment","Working Sheet","Calculations"],"not_rendered":{"charts":4,"images":5,"macros":1,"external_links":0,"defined_names":2,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Sheet4","index":0,"n_rows":47,"n_cols":7,"rows_kept":47,"cut":false,"hidden":true,"merged":[]}
[]
["Gap ID",null,"Control Title","Control Reference","Issue Title","Issue Description","Recommendation"]
[{"$f":"IF(C3=\"\",\"\",1)","v":""},{"$f":"IF(A3=\"\",\"\",SUM(A3:$A$3))","v":""},{"$f":"IF(OR(Assessment!G3=\"Ineffective\", Assessment!G3=\"Partially Effective\"),Assessment!D3,\"\")","v":""},{"$f":"IF(OR(Assessment!G3=\"Ineffective\", Assessment!G3=\"Partially Effective\"),Assessment!E3,\"\")","v":""},{"$f":"IF(C3='Working Sheet'!B3, 'Working Sheet'!D3, \"\")","v":""},{"$f":"IF(C3='Working Sheet'!B3, 'Working Sheet'!E3, \"\")","v":""},{"$f":"IF(C3='Working Sheet'!B3, 'Working Sheet'!F3, \"\")","v":""}]
[{"$f":"IF(C4=\"\",\"\",1)","v":""},{"$f":"IF(A4=\"\",\"\",SUM(A$3:$A4))","v":""},{"$f":"IF(OR(Assessment!G4=\"Ineffective\", Assessment!G4=\"Partially Effective\"),Assessment!D4,\"\")","v":""},{"$f":"IF(OR(Assessment!G4=\"Ineffective\", Assessment!G4=\"Partially Effective\"),Assessment!E4,\"\")","v":""},{"$f":"IF(C4='Working Sheet'!B4, 'Working Sheet'!D4, \"\")","v":""},{"$f":"IF(C4='Working Sheet'!B4, 'Working Sheet'!E4, \"\")","v":""},{"$f":"IF(C4='Working Sheet'!B4, 'Working Sheet'!F4, \"\")","v":""}]
["",{"$f":"IF(A5=\"\",\"\",SUM(A$3:$A5))","v":""},{"$f":"IF(OR(Assessment!G5=\"Ineffective\", Assessment!G5=\"Partially Effective\"),Assessment!D5,\"\")","v":""},{"$f":"IF(OR(Assessment!G5=\"Ineffective\", Assessment!G5=\"Partially Effective\"),Assessment!E5,\"\")","v":""},{"$f":"IF(C5='Working Sheet'!B5, 'Working Sheet'!D5, \"\")","v":""},{"$f":"IF(C5='Working Sheet'!B5, 'Working Sheet'!E5, \"\")","v":""},{"$f":"IF(C5='Working Sheet'!B5, 'Working Sheet'!F5, \"\")","v":""}]
["",{"$f":"IF(A6=\"\",\"\",SUM(A$3:$A6))","v":""},{"$f":"IF(OR(Assessment!G6=\"Ineffective\", Assessment!G6=\"Partially Effective\"),Assessment!D6,\"\")","v":""},{"$f":"IF(OR(Assessment!G6=\"Ineffective\", Assessment!G6=\"Partially Effective\"),Assessment!E6,\"\")","v":""},{"$f":"IF(C6='Working Sheet'!B6, 'Working Sheet'!D6, \"\")","v":""},{"$f":"IF(C6='Working Sheet'!B6, 'Working Sheet'!E6, \"\")","v":""},{"$f":"IF(C6='Working Sheet'!B6, 'Working Sheet'!F6, \"\")","v":""}]
["",{"$f":"IF(A7=\"\",\"\",SUM(A$3:$A7))","v":""},{"$f":"IF(OR(Assessment!G7=\"Ineffective\", Assessment!G7=\"Partially Effective\"),Assessment!D7,\"\")","v":""},{"$f":"IF(OR(Assessment!G7=\"Ineffective\", Assessment!G7=\"Partially Effective\"),Assessment!E7,\"\")","v":""},{"$f":"IF(C7='Working Sheet'!B7, 'Working Sheet'!D7, \"\")","v":""},{"$f":"IF(C7='Working Sheet'!B7, 'Working Sheet'!E7, \"\")","v":""},{"$f":"IF(C7='Working Sheet'!B7, 'Working Sheet'!F7, \"\")","v":""}]
["",{"$f":"IF(A8=\"\",\"\",SUM(A$3:$A8))","v":""},{"$f":"IF(OR(Assessment!G8=\"Ineffective\", Assessment!G8=\"Partially Effective\"),Assessment!D8,\"\")","v":""},{"$f":"IF(OR(Assessment!G8=\"Ineffective\", Assessment!G8=\"Partially Effective\"),Assessment!E8,\"\")","v":""},{"$f":"IF(C8='Working Sheet'!B8, 'Working Sheet'!D8, \"\")","v":""},{"$f":"IF(C8='Working Sheet'!B8, 'Working Sheet'!E8, \"\")","v":""},{"$f":"IF(C8='Working Sheet'!B8, 'Working Sheet'!F8, \"\")","v":""}]
["",{"$f":"IF(A9=\"\",\"\",SUM(A$3:$A9))","v":""},{"$f":"IF(OR(Assessment!G9=\"Ineffective\", Assessment!G9=\"Partially Effective\"),Assessment!D9,\"\")","v":""},{"$f":"IF(OR(Assessment!G9=\"Ineffective\", Assessment!G9=\"Partially Effective\"),Assessment!E9,\"\")","v":""},{"$f":"IF(C9='Working Sheet'!B9, 'Working Sheet'!D9, \"\")","v":""},{"$f":"IF(C9='Working Sheet'!B9, 'Working Sheet'!E9, \"\")","v":""},{"$f":"IF(C9='Working Sheet'!B9, 'Working Sheet'!F9, \"\")","v":""}]
["",{"$f":"IF(A10=\"\",\"\",SUM(A$3:$A10))","v":""},{"$f":"IF(OR(Assessment!G10=\"Ineffective\", Assessment!G10=\"Partially Effective\"),Assessment!D10,\"\")","v":""},{"$f":"IF(OR(Assessment!G10=\"Ineffective\", Assessment!G10=\"Partially Effective\"),Assessment!E10,\"\")","v":""},{"$f":"IF(C10='Working Sheet'!B10, 'Working Sheet'!D10, \"\")","v":""},{"$f":"IF(C10='Working Sheet'!B10, 'Working Sheet'!E10, \"\")","v":""},{"$f":"IF(C10='Working Sheet'!B10, 'Working Sheet'!F10, \"\")","v":""}]
["",{"$f":"IF(A11=\"\",\"\",SUM(A$3:$A11))","v":""},{"$f":"IF(OR(Assessment!G11=\"Ineffective\", Assessment!G11=\"Partially Effective\"),Assessment!D11,\"\")","v":""},{"$f":"IF(OR(Assessment!G11=\"Ineffective\", Assessment!G11=\"Partially Effective\"),Assessment!E11,\"\")","v":""},{"$f":"IF(C11='Working Sheet'!B11, 'Working Sheet'!D11, \"\")","v":""},{"$f":"IF(C11='Working Sheet'!B11, 'Working Sheet'!E11, \"\")","v":""},{"$f":"IF(C11='Working Sheet'!B11, 'Working Sheet'!F11, \"\")","v":""}]
["",{"$f":"IF(A12=\"\",\"\",SUM(A$3:$A12))","v":""},{"$f":"IF(OR(Assessment!G12=\"Ineffective\", Assessment!G12=\"Partially Effective\"),Assessment!D12,\"\")","v":""},{"$f":"IF(OR(Assessment!G12=\"Ineffective\", Assessment!G12=\"Partially Effective\"),Assessment!E12,\"\")","v":""},{"$f":"IF(C12='Working Sheet'!B12, 'Working Sheet'!D12, \"\")","v":""},{"$f":"IF(C12='Working Sheet'!B12, 'Working Sheet'!E12, \"\")","v":""},{"$f":"IF(C12='Working Sheet'!B12, 'Working Sheet'!F12, \"\")","v":""}]
["",{"$f":"IF(A13=\"\",\"\",SUM(A$3:$A13))","v":""},{"$f":"IF(OR(Assessment!G13=\"Ineffective\", Assessment!G13=\"Partially Effective\"),Assessment!D13,\"\")","v":""},{"$f":"IF(OR(Assessment!G13=\"Ineffective\", Assessment!G13=\"Partially Effective\"),Assessment!E13,\"\")","v":""},{"$f":"IF(C13='Working Sheet'!B13, 'Working Sheet'!D13, \"\")","v":""},{"$f":"IF(C13='Working Sheet'!B13, 'Working Sheet'!E13, \"\")","v":""},{"$f":"IF(C13='Working Sheet'!B13, 'Working Sheet'!F13, \"\")","v":""}]
["",{"$f":"IF(A14=\"\",\"\",SUM(A$3:$A14))","v":""},{"$f":"IF(OR(Assessment!G14=\"Ineffective\", Assessment!G14=\"Partially Effective\"),Assessment!D14,\"\")","v":""},{"$f":"IF(OR(Assessment!G14=\"Ineffective\", Assessment!G14=\"Partially Effective\"),Assessment!E14,\"\")","v":""},{"$f":"IF(C14='Working Sheet'!B14, 'Working Sheet'!D14, \"\")","v":""},{"$f":"IF(C14='Working Sheet'!B14, 'Working Sheet'!E14, \"\")","v":""},{"$f":"IF(C14='Working Sheet'!B14, 'Working Sheet'!F14, \"\")","v":""}]
["",{"$f":"IF(A15=\"\",\"\",SUM(A$3:$A15))","v":""},{"$f":"IF(OR(Assessment!G15=\"Ineffective\", Assessment!G15=\"Partially Effective\"),Assessment!D15,\"\")","v":""},{"$f":"IF(OR(Assessment!G15=\"Ineffective\", Assessment!G15=\"Partially Effective\"),Assessment!E15,\"\")","v":""},{"$f":"IF(C15='Working Sheet'!B15, 'Working Sheet'!D15, \"\")","v":""},{"$f":"IF(C15='Working Sheet'!B15, 'Working Sheet'!E15, \"\")","v":""},{"$f":"IF(C15='Working Sheet'!B15, 'Working Sheet'!F15, \"\")","v":""}]
["",{"$f":"IF(A16=\"\",\"\",SUM(A$3:$A16))","v":""},{"$f":"IF(OR(Assessment!G16=\"Ineffective\", Assessment!G16=\"Partially Effective\"),Assessment!D16,\"\")","v":""},{"$f":"IF(OR(Assessment!G16=\"Ineffective\", Assessment!G16=\"Partially Effective\"),Assessment!E16,\"\")","v":""},{"$f":"IF(C16='Working Sheet'!B16, 'Working Sheet'!D16, \"\")","v":""},{"$f":"IF(C16='Working Sheet'!B16, 'Working Sheet'!E16, \"\")","v":""},{"$f":"IF(C16='Working Sheet'!B16, 'Working Sheet'!F16, \"\")","v":""}]
["",{"$f":"IF(A17=\"\",\"\",SUM(A$3:$A17))","v":""},{"$f":"IF(OR(Assessment!G17=\"Ineffective\", Assessment!G17=\"Partially Effective\"),Assessment!D17,\"\")","v":""},{"$f":"IF(OR(Assessment!G17=\"Ineffective\", Assessment!G17=\"Partially Effective\"),Assessment!E17,\"\")","v":""},{"$f":"IF(C17='Working Sheet'!B17, 'Working Sheet'!D17, \"\")","v":""},{"$f":"IF(C17='Working Sheet'!B17, 'Working Sheet'!E17, \"\")","v":""},{"$f":"IF(C17='Working Sheet'!B17, 'Working Sheet'!F17, \"\")","v":""}]
["",{"$f":"IF(A18=\"\",\"\",SUM(A$3:$A18))","v":""},{"$f":"IF(OR(Assessment!G18=\"Ineffective\", Assessment!G18=\"Partially Effective\"),Assessment!D18,\"\")","v":""},{"$f":"IF(OR(Assessment!G18=\"Ineffective\", Assessment!G18=\"Partially Effective\"),Assessment!E18,\"\")","v":""},{"$f":"IF(C18='Working Sheet'!B18, 'Working Sheet'!D18, \"\")","v":""},{"$f":"IF(C18='Working Sheet'!B18, 'Working Sheet'!E18, \"\")","v":""},{"$f":"IF(C18='Working Sheet'!B18, 'Working Sheet'!F18, \"\")","v":""}]
["",{"$f":"IF(A19=\"\",\"\",SUM(A$3:$A19))","v":""},{"$f":"IF(OR(Assessment!G19=\"Ineffective\", Assessment!G19=\"Partially Effective\"),Assessment!D19,\"\")","v":""},{"$f":"IF(OR(Assessment!G19=\"Ineffective\", Assessment!G19=\"Partially Effective\"),Assessment!E19,\"\")","v":""},{"$f":"IF(C19='Working Sheet'!B19, 'Working Sheet'!D19, \"\")","v":""},{"$f":"IF(C19='Working Sheet'!B19, 'Working Sheet'!E19, \"\")","v":""},{"$f":"IF(C19='Working Sheet'!B19, 'Working Sheet'!F19, \"\")","v":""}]
["",{"$f":"IF(A20=\"\",\"\",SUM(A$3:$A20))","v":""},{"$f":"IF(OR(Assessment!G20=\"Ineffective\", Assessment!G20=\"Partially Effective\"),Assessment!D20,\"\")","v":""},{"$f":"IF(OR(Assessment!G20=\"Ineffective\", Assessment!G20=\"Partially Effective\"),Assessment!E20,\"\")","v":""},{"$f":"IF(C20='Working Sheet'!B20, 'Working Sheet'!D20, \"\")","v":""},{"$f":"IF(C20='Working Sheet'!B20, 'Working Sheet'!E20, \"\")","v":""},{"$f":"IF(C20='Working Sheet'!B20, 'Working Sheet'!F20, \"\")","v":""}]
["",{"$f":"IF(A21=\"\",\"\",SUM(A$3:$A21))","v":""},{"$f":"IF(OR(Assessment!G21=\"Ineffective\", Assessment!G21=\"Partially Effective\"),Assessment!D21,\"\")","v":""},{"$f":"IF(OR(Assessment!G21=\"Ineffective\", Assessment!G21=\"Partially Effective\"),Assessment!E21,\"\")","v":""},{"$f":"IF(C21='Working Sheet'!B21, 'Working Sheet'!D21, \"\")","v":""},{"$f":"IF(C21='Working Sheet'!B21, 'Working Sheet'!E21, \"\")","v":""},{"$f":"IF(C21='Working Sheet'!B21, 'Working Sheet'!F21, \"\")","v":""}]
["",{"$f":"IF(A22=\"\",\"\",SUM(A$3:$A22))","v":""},{"$f":"IF(OR(Assessment!G22=\"Ineffective\", Assessment!G22=\"Partially Effective\"),Assessment!D22,\"\")","v":""},{"$f":"IF(OR(Assessment!G22=\"Ineffective\", Assessment!G22=\"Partially Effective\"),Assessment!E22,\"\")","v":""},{"$f":"IF(C22='Working Sheet'!B22, 'Working Sheet'!D22, \"\")","v":""},{"$f":"IF(C22='Working Sheet'!B22, 'Working Sheet'!E22, \"\")","v":""},{"$f":"IF(C22='Working Sheet'!B22, 'Working Sheet'!F22, \"\")","v":""}]
["",{"$f":"IF(A23=\"\",\"\",SUM(A$3:$A23))","v":""},{"$f":"IF(OR(Assessment!G23=\"Ineffective\", Assessment!G23=\"Partially Effective\"),Assessment!D23,\"\")","v":""},{"$f":"IF(OR(Assessment!G23=\"Ineffective\", Assessment!G23=\"Partially Effective\"),Assessment!E23,\"\")","v":""},{"$f":"IF(C23='Working Sheet'!B23, 'Working Sheet'!D23, \"\")","v":""},{"$f":"IF(C23='Working Sheet'!B23, 'Working Sheet'!E23, \"\")","v":""},{"$f":"IF(C23='Working Sheet'!B23, 'Working Sheet'!F23, \"\")","v":""}]
["",{"$f":"IF(A24=\"\",\"\",SUM(A$3:$A24))","v":""},{"$f":"IF(OR(Assessment!G24=\"Ineffective\", Assessment!G24=\"Partially Effective\"),Assessment!D24,\"\")","v":""},{"$f":"IF(OR(Assessment!G24=\"Ineffective\", Assessment!G24=\"Partially Effective\"),Assessment!E24,\"\")","v":""},{"$f":"IF(C24='Working Sheet'!B24, 'Working Sheet'!D24, \"\")","v":""},{"$f":"IF(C24='Working Sheet'!B24, 'Working Sheet'!E24, \"\")","v":""},{"$f":"IF(C24='Working Sheet'!B24, 'Working Sheet'!F24, \"\")","v":""}]
["",{"$f":"IF(A25=\"\",\"\",SUM(A$3:$A25))","v":""},{"$f":"IF(OR(Assessment!G25=\"Ineffective\", Assessment!G25=\"Partially Effective\"),Assessment!D25,\"\")","v":""},{"$f":"IF(OR(Assessment!G25=\"Ineffective\", Assessment!G25=\"Partially Effective\"),Assessment!E25,\"\")","v":""},{"$f":"IF(C25='Working Sheet'!B25, 'Working Sheet'!D25, \"\")","v":""},{"$f":"IF(C25='Working Sheet'!B25, 'Working Sheet'!E25, \"\")","v":""},{"$f":"IF(C25='Working Sheet'!B25, 'Working Sheet'!F25, \"\")","v":""}]
["",{"$f":"IF(A26=\"\",\"\",SUM(A$3:$A26))","v":""},{"$f":"IF(OR(Assessment!G26=\"Ineffective\", Assessment!G26=\"Partially Effective\"),Assessment!D26,\"\")","v":""},{"$f":"IF(OR(Assessment!G26=\"Ineffective\", Assessment!G26=\"Partially Effective\"),Assessment!E26,\"\")","v":""},{"$f":"IF(C26='Working Sheet'!B27, 'Working Sheet'!D27, \"\")","v":""},{"$f":"IF(C26='Working Sheet'!B27, 'Working Sheet'!E27, \"\")","v":""},{"$f":"IF(C26='Working Sheet'!B27, 'Working Sheet'!F27, \"\")","v":""}]
["",{"$f":"IF(A27=\"\",\"\",SUM(A$3:$A27))","v":""},{"$f":"IF(OR(Assessment!G27=\"Ineffective\", Assessment!G27=\"Partially Effective\"),Assessment!D27,\"\")","v":""},{"$f":"IF(OR(Assessment!G27=\"Ineffective\", Assessment!G27=\"Partially Effective\"),Assessment!E27,\"\")","v":""},{"$f":"IF(C27='Working Sheet'!B28, 'Working Sheet'!D28, \"\")","v":""},{"$f":"IF(C27='Working Sheet'!B28, 'Working Sheet'!E28, \"\")","v":""},{"$f":"IF(C27='Working Sheet'!B28, 'Working Sheet'!F28, \"\")","v":""}]
["",{"$f":"IF(A28=\"\",\"\",SUM(A$3:$A28))","v":""},{"$f":"IF(OR(Assessment!G28=\"Ineffective\", Assessment!G28=\"Partially Effective\"),Assessment!D28,\"\")","v":""},{"$f":"IF(OR(Assessment!G28=\"Ineffective\", Assessment!G28=\"Partially Effective\"),Assessment!E28,\"\")","v":""},{"$f":"IF(C28='Working Sheet'!B29, 'Working Sheet'!D29, \"\")","v":""},{"$f":"IF(C28='Working Sheet'!B29, 'Working Sheet'!E29, \"\")","v":""},{"$f":"IF(C28='Working Sheet'!B29, 'Working Sheet'!F29, \"\")","v":""}]
["",{"$f":"IF(A29=\"\",\"\",SUM(A$3:$A29))","v":""},{"$f":"IF(OR(Assessment!G29=\"Ineffective\", Assessment!G29=\"Partially Effective\"),Assessment!D29,\"\")","v":""},{"$f":"IF(OR(Assessment!G29=\"Ineffective\", Assessment!G29=\"Partially Effective\"),Assessment!E29,\"\")","v":""},{"$f":"IF(C29='Working Sheet'!B30, 'Working Sheet'!D30, \"\")","v":""},{"$f":"IF(C29='Working Sheet'!B30, 'Working Sheet'!E30, \"\")","v":""},{"$f":"IF(C29='Working Sheet'!B30, 'Working Sheet'!F30, \"\")","v":""}]
["",{"$f":"IF(A30=\"\",\"\",SUM(A$3:$A30))","v":""},{"$f":"IF(OR(Assessment!G30=\"Ineffective\", Assessment!G30=\"Partially Effective\"),Assessment!D30,\"\")","v":""},{"$f":"IF(OR(Assessment!G30=\"Ineffective\", Assessment!G30=\"Partially Effective\"),Assessment!E30,\"\")","v":""},{"$f":"IF(C30='Working Sheet'!B31, 'Working Sheet'!D31, \"\")","v":""},{"$f":"IF(C30='Working Sheet'!B31, 'Working Sheet'!E31, \"\")","v":""},{"$f":"IF(C30='Working Sheet'!B31, 'Working Sheet'!F31, \"\")","v":""}]
["",{"$f":"IF(A31=\"\",\"\",SUM(A$3:$A31))","v":""},{"$f":"IF(OR(Assessment!G31=\"Ineffective\", Assessment!G31=\"Partially Effective\"),Assessment!D31,\"\")","v":""},{"$f":"IF(OR(Assessment!G31=\"Ineffective\", Assessment!G31=\"Partially Effective\"),Assessment!E31,\"\")","v":""},{"$f":"IF(C31='Working Sheet'!B32, 'Working Sheet'!D32, \"\")","v":""},{"$f":"IF(C31='Working Sheet'!B32, 'Working Sheet'!E32, \"\")","v":""},{"$f":"IF(C31='Working Sheet'!B32, 'Working Sheet'!F32, \"\")","v":""}]
["",{"$f":"IF(A32=\"\",\"\",SUM(A$3:$A32))","v":""},{"$f":"IF(OR(Assessment!G32=\"Ineffective\", Assessment!G32=\"Partially Effective\"),Assessment!D32,\"\")","v":""},{"$f":"IF(OR(Assessment!G32=\"Ineffective\", Assessment!G32=\"Partially Effective\"),Assessment!E32,\"\")","v":""},{"$f":"IF(C32='Working Sheet'!B33, 'Working Sheet'!D33, \"\")","v":""},{"$f":"IF(C32='Working Sheet'!B33, 'Working Sheet'!E33, \"\")","v":""},{"$f":"IF(C32='Working Sheet'!B33, 'Working Sheet'!F33, \"\")","v":""}]
["",{"$f":"IF(A33=\"\",\"\",SUM(A$3:$A33))","v":""},{"$f":"IF(OR(Assessment!G33=\"Ineffective\", Assessment!G33=\"Partially Effective\"),Assessment!D33,\"\")","v":""},{"$f":"IF(OR(Assessment!G33=\"Ineffective\", Assessment!G33=\"Partially Effective\"),Assessment!E33,\"\")","v":""},{"$f":"IF(C33='Working Sheet'!B34, 'Working Sheet'!D34, \"\")","v":""},{"$f":"IF(C33='Working Sheet'!B34, 'Working Sheet'!E34, \"\")","v":""},{"$f":"IF(C33='Working Sheet'!B34, 'Working Sheet'!F34, \"\")","v":""}]
["",{"$f":"IF(A34=\"\",\"\",SUM(A$3:$A34))","v":""},{"$f":"IF(OR(Assessment!G34=\"Ineffective\", Assessment!G34=\"Partially Effective\"),Assessment!D34,\"\")","v":""},{"$f":"IF(OR(Assessment!G34=\"Ineffective\", Assessment!G34=\"Partially Effective\"),Assessment!E34,\"\")","v":""},{"$f":"IF(C34='Working Sheet'!B35, 'Working Sheet'!D35, \"\")","v":""},{"$f":"IF(C34='Working Sheet'!B35, 'Working Sheet'!E35, \"\")","v":""},{"$f":"IF(C34='Working Sheet'!B35, 'Working Sheet'!F35, \"\")","v":""}]
["",{"$f":"IF(A35=\"\",\"\",SUM(A$3:$A35))","v":""},{"$f":"IF(OR(Assessment!G35=\"Ineffective\", Assessment!G35=\"Partially Effective\"),Assessment!D35,\"\")","v":""},{"$f":"IF(OR(Assessment!G35=\"Ineffective\", Assessment!G35=\"Partially Effective\"),Assessment!E35,\"\")","v":""},{"$f":"IF(C35='Working Sheet'!B36, 'Working Sheet'!D36, \"\")","v":""},{"$f":"IF(C35='Working Sheet'!B36, 'Working Sheet'!E36, \"\")","v":""},{"$f":"IF(C35='Working Sheet'!B36, 'Working Sheet'!F36, \"\")","v":""}]
["",{"$f":"IF(A36=\"\",\"\",SUM(A$3:$A36))","v":""},{"$f":"IF(OR(Assessment!G36=\"Ineffective\", Assessment!G36=\"Partially Effective\"),Assessment!D36,\"\")","v":""},{"$f":"IF(OR(Assessment!G36=\"Ineffective\", Assessment!G36=\"Partially Effective\"),Assessment!E36,\"\")","v":""},{"$f":"IF(C36='Working Sheet'!B37, 'Working Sheet'!D37, \"\")","v":""},{"$f":"IF(C36='Working Sheet'!B37, 'Working Sheet'!E37, \"\")","v":""},{"$f":"IF(C36='Working Sheet'!B37, 'Working Sheet'!F37, \"\")","v":""}]
["",{"$f":"IF(A37=\"\",\"\",SUM(A$3:$A37))","v":""},{"$f":"IF(OR(Assessment!G37=\"Ineffective\", Assessment!G37=\"Partially Effective\"),Assessment!D37,\"\")","v":""},{"$f":"IF(OR(Assessment!G37=\"Ineffective\", Assessment!G37=\"Partially Effective\"),Assessment!E37,\"\")","v":""},{"$f":"IF(C37='Working Sheet'!B38, 'Working Sheet'!D38, \"\")","v":""},{"$f":"IF(C37='Working Sheet'!B38, 'Working Sheet'!E38, \"\")","v":""},{"$f":"IF(C37='Working Sheet'!B38, 'Working Sheet'!F38, \"\")","v":""}]
["",{"$f":"IF(A38=\"\",\"\",SUM(A$3:$A38))","v":""},{"$f":"IF(OR(Assessment!G38=\"Ineffective\", Assessment!G38=\"Partially Effective\"),Assessment!D38,\"\")","v":""},{"$f":"IF(OR(Assessment!G38=\"Ineffective\", Assessment!G38=\"Partially Effective\"),Assessment!E38,\"\")","v":""},{"$f":"IF(C38='Working Sheet'!B39, 'Working Sheet'!D39, \"\")","v":""},{"$f":"IF(C38='Working Sheet'!B39, 'Working Sheet'!E39, \"\")","v":""},{"$f":"IF(C38='Working Sheet'!B39, 'Working Sheet'!F39, \"\")","v":""}]
["",{"$f":"IF(A39=\"\",\"\",SUM(A$3:$A39))","v":""},{"$f":"IF(OR(Assessment!G39=\"Ineffective\", Assessment!G39=\"Partially Effective\"),Assessment!D39,\"\")","v":""},{"$f":"IF(OR(Assessment!G39=\"Ineffective\", Assessment!G39=\"Partially Effective\"),Assessment!E39,\"\")","v":""},{"$f":"IF(C39='Working Sheet'!B40, 'Working Sheet'!D40, \"\")","v":""},{"$f":"IF(C39='Working Sheet'!B40, 'Working Sheet'!E40, \"\")","v":""},{"$f":"IF(C39='Working Sheet'!B40, 'Working Sheet'!F40, \"\")","v":""}]
["",{"$f":"IF(A40=\"\",\"\",SUM(A$3:$A40))","v":""},{"$f":"IF(OR(Assessment!G40=\"Ineffective\", Assessment!G40=\"Partially Effective\"),Assessment!D40,\"\")","v":""},{"$f":"IF(OR(Assessment!G40=\"Ineffective\", Assessment!G40=\"Partially Effective\"),Assessment!E40,\"\")","v":""},{"$f":"IF(C40='Working Sheet'!B41, 'Working Sheet'!D41, \"\")","v":""},{"$f":"IF(C40='Working Sheet'!B41, 'Working Sheet'!E41, \"\")","v":""},{"$f":"IF(C40='Working Sheet'!B41, 'Working Sheet'!F41, \"\")","v":""}]
["",{"$f":"IF(A41=\"\",\"\",SUM(A$3:$A41))","v":""},{"$f":"IF(OR(Assessment!G41=\"Ineffective\", Assessment!G41=\"Partially Effective\"),Assessment!D41,\"\")","v":""},{"$f":"IF(OR(Assessment!G41=\"Ineffective\", Assessment!G41=\"Partially Effective\"),Assessment!E41,\"\")","v":""},{"$f":"IF(C41='Working Sheet'!B42, 'Working Sheet'!D42, \"\")","v":""},{"$f":"IF(C41='Working Sheet'!B42, 'Working Sheet'!E42, \"\")","v":""},{"$f":"IF(C41='Working Sheet'!B42, 'Working Sheet'!F42, \"\")","v":""}]
["",{"$f":"IF(A42=\"\",\"\",SUM(A$3:$A42))","v":""},{"$f":"IF(OR(Assessment!G42=\"Ineffective\", Assessment!G42=\"Partially Effective\"),Assessment!D42,\"\")","v":""},{"$f":"IF(OR(Assessment!G42=\"Ineffective\", Assessment!G42=\"Partially Effective\"),Assessment!E42,\"\")","v":""},{"$f":"IF(C42='Working Sheet'!B43, 'Working Sheet'!D43, \"\")","v":""},{"$f":"IF(C42='Working Sheet'!B43, 'Working Sheet'!E43, \"\")","v":""},{"$f":"IF(C42='Working Sheet'!B43, 'Working Sheet'!F43, \"\")","v":""}]
["",{"$f":"IF(A43=\"\",\"\",SUM(A$3:$A43))","v":""},{"$f":"IF(OR(Assessment!G43=\"Ineffective\", Assessment!G43=\"Partially Effective\"),Assessment!D43,\"\")","v":""},{"$f":"IF(OR(Assessment!G43=\"Ineffective\", Assessment!G43=\"Partially Effective\"),Assessment!E43,\"\")","v":""},{"$f":"IF(C43='Working Sheet'!B44, 'Working Sheet'!D44, \"\")","v":""},{"$f":"IF(C43='Working Sheet'!B44, 'Working Sheet'!E44, \"\")","v":""},{"$f":"IF(C43='Working Sheet'!B44, 'Working Sheet'!F44, \"\")","v":""}]
["",{"$f":"IF(A44=\"\",\"\",SUM(A$3:$A44))","v":""},{"$f":"IF(OR(Assessment!G44=\"Ineffective\", Assessment!G44=\"Partially Effective\"),Assessment!D44,\"\")","v":""},{"$f":"IF(OR(Assessment!G44=\"Ineffective\", Assessment!G44=\"Partially Effective\"),Assessment!E44,\"\")","v":""},{"$f":"IF(C44='Working Sheet'!B45, 'Working Sheet'!D45, \"\")","v":""},{"$f":"IF(C44='Working Sheet'!B45, 'Working Sheet'!E45, \"\")","v":""},{"$f":"IF(C44='Working Sheet'!B45, 'Working Sheet'!F45, \"\")","v":""}]
["",{"$f":"IF(A45=\"\",\"\",SUM(A$3:$A45))","v":""},{"$f":"IF(OR(Assessment!G45=\"Ineffective\", Assessment!G45=\"Partially Effective\"),Assessment!D45,\"\")","v":""},{"$f":"IF(OR(Assessment!G45=\"Ineffective\", Assessment!G45=\"Partially Effective\"),Assessment!E45,\"\")","v":""},{"$f":"IF(C45='Working Sheet'!B46, 'Working Sheet'!D46, \"\")","v":""},{"$f":"IF(C45='Working Sheet'!B46, 'Working Sheet'!E46, \"\")","v":""},{"$f":"IF(C45='Working Sheet'!B46, 'Working Sheet'!F46, \"\")","v":""}]
[]
[null,{"$f":"MAX(B1:B46)","v":0}]

{"sheet":"Report-Testing","index":1,"n_rows":207,"n_cols":10,"rows_kept":207,"cut":false,"hidden":true,"merged":[[111,5,111,7],[130,5,130,8],[161,5,161,8],[105,5,105,7],[106,5,106,7],[107,5,107,7],[108,5,108,7],[109,5,109,7],[110,5,110,7],[104,5,104,7],[10,1,11,9],[17,1,18,9],[101,5,101,8],[102,5,102,7],[103,5,103,7]]}
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
[".","Privacy by Design Assessment Report"]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
[".",null,null,null,null,null,null,null,{"$f":"'Initial Information Request'!D7","v":0}]
["."]
["."]
[]
["."]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["."]
["."]
[".",null,null,null,null,"Overview about the Application"]
[".",null,null,null,null,"NAME OF THE APPLICATION",null,null,{"$f":"IF('Initial Information Request'!D5=0,\"\",'Initial Information Request'!D5)","v":""},".\n."]
[".",null,null,null,null,"NAME OF THE ORGANIZATION",null,null,{"$f":"IF('Initial Information Request'!D7=0,\"\",'Initial Information Request'!D7)","v":""},".\n."]
[".",null,null,null,null,"DETAILS OF THE ASSESSOR",null,null,{"$f":"IF('Initial Information Request'!D9=0,\"\",'Initial Information Request'!D9)","v":""},".\n."]
[".",null,null,null,null,"DATE OF THE ASSESSMENT",null,null,{"$f":"IF('Initial Information Request'!D11=0,\"\",'Initial Information Request'!D11)","v":""},".\n."]
[".",null,null,null,null,"DETAILS OF PROCESSING ACTIVITIES CARRIED OUT",null,null,{"$f":"IF('Initial Information Request'!D27=0,\"\",'Initial Information Request'!D27)","v":""},".\n.\n.\n.\n"]
[".",null,null,null,null,"PERSONAL DATA ATTRIBUTES PROCESSED ",null,null,{"$f":"IF('Initial Information Request'!D17=0,\"\",'Initial Information Request'!D17)","v":""},".\n.\n.\n.\n"]
[".",null,null,null,null,"LIST OF UPSTREAM AND DOWNSTREAM APPLICATIONS",null,null,{"$f":"IF('Initial Information Request'!D23=0,\"\",'Initial Information Request'!D23)","v":""},".\n.\n.\n."]
[".",null,null,null,null,"APPLICATION HOSTING DETAILS",null,null,{"$f":"IF('Initial Information Request'!D33=0,\"\",'Initial Information Request'!D33)","v":""},".\n."]
[".",null,null,null,null,"APPLICATION ARCHITECTURE",null,null,{"$f":"IF('Initial Information Request'!D37=0,\"\",'Initial Information Request'!D37)","v":""},".\n."]
[".",null,null,null,null,"THIRD PARTIES INVOLVED",null,null,{"$f":"IF('Initial Information Request'!D31=0,\"\",'Initial Information Request'!D31)","v":""},".\n.\n.\n."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
[".",null,null,null,null,"Assessment Results - Dashboard"]
["."]
["."]
[]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
["."]
[".",null,null,null,null,"PRIVACY BY DESIGN ASSESSMENT - FINDINGS AND PROPOSED WAY FORWARD"]
[".",null,null,null,null,"Gap ID","Gap ","Gap Description","Recommendation"]
[".",null,null,null,1,{"$f":"IF('Report-Testing'!E164=Calculations!E34,Calculations!F34,\"\")","v":"G_01"},{"$f":"VLOOKUP($E$164,Sheet4!$B:$G,4,FALSE)","v":{"$error":"#N/A"}},{"$f":"_xlfn.IFNA(VLOOKUP(E164,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E164,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[".",null,null,null,{"$f":"IF(E164<Sheet4!$B$47,E164+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E165=Calculations!E35,Calculations!F35,\"\")","v":""},{"$f":"VLOOKUP(E165,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E165,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E165,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[".",null,null,null,{"$f":"IF(E165<Sheet4!$B$47,E165+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E166=Calculations!E36,Calculations!F36,\"\")","v":""},{"$f":"VLOOKUP(E166,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E166,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E166,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[".",null,null,null,{"$f":"IF(E166<Sheet4!$B$47,E166+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E167=Calculations!E37,Calculations!F37,\"\")","v":""},{"$f":"VLOOKUP(E167,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E167,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E167,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[".",null,null,null,{"$f":"IF(E167<Sheet4!$B$47,E167+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E168=Calculations!E38,Calculations!F38,\"\")","v":""},{"$f":"VLOOKUP(E168,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E168,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E168,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E168<Sheet4!$B$47,E168+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E169=Calculations!E39,Calculations!F39,\"\")","v":""},{"$f":"VLOOKUP(E169,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E169,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E169,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E169<Sheet4!$B$47,E169+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E170=Calculations!E40,Calculations!F40,\"\")","v":""},{"$f":"VLOOKUP(E170,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E170,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E170,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E170<Sheet4!$B$47,E170+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E171=Calculations!E41,Calculations!F41,\"\")","v":""},{"$f":"VLOOKUP(E171,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E171,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E171,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E171<Sheet4!$B$47,E171+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E172=Calculations!E42,Calculations!F42,\"\")","v":""},{"$f":"VLOOKUP(E172,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E172,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E172,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E172<Sheet4!$B$47,E172+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E173=Calculations!E43,Calculations!F43,\"\")","v":""},{"$f":"VLOOKUP(E173,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E173,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E173,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E173<Sheet4!$B$47,E173+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E174=Calculations!E44,Calculations!F44,\"\")","v":""},{"$f":"VLOOKUP(E174,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E174,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E174,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E174<Sheet4!$B$47,E174+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E175=Calculations!E45,Calculations!F45,\"\")","v":""},{"$f":"VLOOKUP(E175,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E175,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E175,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E175<Sheet4!$B$47,E175+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E176=Calculations!E46,Calculations!F46,\"\")","v":""},{"$f":"VLOOKUP(E176,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E176,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E176,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E176<Sheet4!$B$47,E176+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E177=Calculations!E47,Calculations!F47,\"\")","v":""},{"$f":"VLOOKUP(E177,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E177,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E177,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E177<Sheet4!$B$47,E177+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E178=Calculations!E48,Calculations!F48,\"\")","v":""},{"$f":"VLOOKUP(E178,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E178,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E178,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E178<Sheet4!$B$47,E178+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E179=Calculations!E49,Calculations!F49,\"\")","v":""},{"$f":"VLOOKUP(E179,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E179,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E179,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E179<Sheet4!$B$47,E179+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E180=Calculations!E50,Calculations!F50,\"\")","v":""},{"$f":"VLOOKUP(E180,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E180,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E180,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E180<Sheet4!$B$47,E180+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E181=Calculations!E51,Calculations!F51,\"\")","v":""},{"$f":"VLOOKUP(E181,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E181,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E181,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E181<Sheet4!$B$47,E181+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E182=Calculations!E52,Calculations!F52,\"\")","v":""},{"$f":"VLOOKUP(E182,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E182,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E182,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E182<Sheet4!$B$47,E182+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E183=Calculations!E53,Calculations!F53,\"\")","v":""},{"$f":"VLOOKUP(E183,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E183,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E183,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E183<Sheet4!$B$47,E183+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E184=Calculations!E54,Calculations!F54,\"\")","v":""},{"$f":"VLOOKUP(E184,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E184,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E184,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E184<Sheet4!$B$47,E184+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E185=Calculations!E55,Calculations!F55,\"\")","v":""},{"$f":"VLOOKUP(E185,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E185,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E185,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E185<Sheet4!$B$47,E185+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E186=Calculations!E56,Calculations!F56,\"\")","v":""},{"$f":"VLOOKUP(E186,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E186,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E186,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E186<Sheet4!$B$47,E186+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E187=Calculations!E57,Calculations!F57,\"\")","v":""},{"$f":"VLOOKUP(E187,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E187,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E187,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E187<Sheet4!$B$47,E187+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E188=Calculations!E58,Calculations!F58,\"\")","v":""},{"$f":"VLOOKUP(E188,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E188,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E188,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E188<Sheet4!$B$47,E188+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E189=Calculations!E59,Calculations!F59,\"\")","v":""},{"$f":"VLOOKUP(E189,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E189,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E189,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E189<Sheet4!$B$47,E189+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E190=Calculations!E60,Calculations!F60,\"\")","v":""},{"$f":"VLOOKUP(E190,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E190,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E190,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E190<Sheet4!$B$47,E190+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E191=Calculations!E61,Calculations!F61,\"\")","v":""},{"$f":"VLOOKUP(E191,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E191,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E191,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E191<Sheet4!$B$47,E191+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E192=Calculations!E62,Calculations!F62,\"\")","v":""},{"$f":"VLOOKUP(E192,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E192,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E192,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E192<Sheet4!$B$47,E192+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E193=Calculations!E63,Calculations!F63,\"\")","v":""},{"$f":"VLOOKUP(E193,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E193,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E193,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E193<Sheet4!$B$47,E193+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E194=Calculations!E64,Calculations!F64,\"\")","v":""},{"$f":"VLOOKUP(E194,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E194,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E194,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E194<Sheet4!$B$47,E194+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E195=Calculations!E65,Calculations!F65,\"\")","v":""},{"$f":"VLOOKUP(E195,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E195,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E195,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E195<Sheet4!$B$47,E195+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E196=Calculations!E66,Calculations!F66,\"\")","v":""},{"$f":"VLOOKUP(E196,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E196,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E196,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E196<Sheet4!$B$47,E196+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E197=Calculations!E67,Calculations!F67,\"\")","v":""},{"$f":"VLOOKUP(E197,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E197,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E197,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E197<Sheet4!$B$47,E197+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E198=Calculations!E68,Calculations!F68,\"\")","v":""},{"$f":"VLOOKUP(E198,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E198,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E198,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E198<Sheet4!$B$47,E198+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E199=Calculations!E69,Calculations!F69,\"\")","v":""},{"$f":"VLOOKUP(E199,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E199,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E199,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E199<Sheet4!$B$47,E199+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E200=Calculations!E70,Calculations!F70,\"\")","v":""},{"$f":"VLOOKUP(E200,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E200,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E200,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E200<Sheet4!$B$47,E200+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E201=Calculations!E71,Calculations!F71,\"\")","v":""},{"$f":"VLOOKUP(E201,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E201,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E201,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E201<Sheet4!$B$47,E201+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E202=Calculations!E72,Calculations!F72,\"\")","v":""},{"$f":"VLOOKUP(E202,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E202,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E202,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E202<Sheet4!$B$47,E202+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E203=Calculations!E73,Calculations!F73,\"\")","v":""},{"$f":"VLOOKUP(E203,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E203,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E203,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E203<Sheet4!$B$47,E203+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E204=Calculations!E74,Calculations!F74,\"\")","v":""},{"$f":"VLOOKUP(E204,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E204,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E204,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E204<Sheet4!$B$47,E204+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E205=Calculations!E75,Calculations!F75,\"\")","v":""},{"$f":"VLOOKUP(E205,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E205,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E205,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,{"$f":"IF(E205<Sheet4!$B$47,E205+1,\"\")","v":""},{"$f":"IF('Report-Testing'!E206=Calculations!E76,Calculations!F76,\"\")","v":""},{"$f":"VLOOKUP(E206,Sheet4!B:G,4,FALSE)","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E206,Sheet4!$B:$G,5,FALSE),\"\")","v":""},{"$f":"_xlfn.IFNA(VLOOKUP(E206,Sheet4!$B:$G,6,FALSE),\"\")","v":""}]
[null,null,null,null,null,{"$f":"IF('Report-Testing'!E207=Calculations!E77,Calculations!F77,\"\")","v":""}]

{"sheet":"ThankYou","index":2,"n_rows":35,"n_cols":1,"rows_kept":35,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["."]
["."]
["."]
["."]
["."]
["."]
["."]

{"sheet":"Read this first","index":3,"n_rows":26,"n_cols":3,"rows_kept":26,"cut":false,"hidden":false,"merged":[[1,1,1,2],[18,1,18,2]]}
[]
[null,"PLEASE READ THE BELOW BEFORE PROCEEDING WITH THE TOOL"]
[null,"What is this tool?","This Excel-based assessment tool has been developed with the primary purpose of evaluating whether systems and applications engaged in the processing of personal data incorporate the necessary functionalities in accordance with the principles of Privacy by Design and the requirements stipulated in the Personal Data Privacy Protection Law (PDPPL).\n\nIt is essential to emphasize that this tool is specifically designed for assessing the functionality of systems and applications concerning data privacy and should not be utilized to gauge an organization's overall compliance status. The assessment encompasses controls that extend beyond the regulatory framework established by the PDPPL.\n\nFollowing the completion of the assessment, a comprehensive report will be generated. This report will provide a detailed summary of all identified privacy gaps, accompanied by relevant recommendations and guidance.\n\nPlease take note that the current version of this tool is in its beta phase, and our team is actively engaged in enhancing its features. We anticipate releasing another iteration next year and warmly welcome any feedback you may have during this interim period."]
[null,"Scope and Applicability ","The scope of this assessment is specifically limited to systems and applications involved in the processing of personal data. With regards to the stakeholders, this applies to the Privacy Team, owners of systems and applications, IT Team, Information Security team and owners of processing activities carried out using the systems and applications. "]
[null,"References used to build this tool","The controls used in the tool are primarily built on top of the below:\n- PDPPL Requirements \n- Privacy by Design Principles."]
[null,"What is the need to conduct Privacy by Design Assessments?","Privacy by Design (PbD) assessments play a significant role in safeguarding the individuals' privacy and personal information throughout the development lifecycle of systems and applications. The significance of Privacy by Design assessments stems from several pivotal factors, all focused on the below core objectives:\n- \tEnsuring Regulatory compliance\n- \tManaging and reducing Privacy risks\n- \tMinimizing post development costs\n- \tImproves individual trust\n- \tCompliance with Privacy principles such as data minimization, purpose limitation and storage limitation \n- \tIncreases competitive advantage. "]
[null,"What areas/domains are covered in the tool","The control library that is used to assess the systems and applications can be categorized to the below seven domains:\n- Transparency : Being open and honest about privacy practices with regards to the underlying processing activities carried out using the systems and applications. \n- Consent Management: Managing the individuals consent across the consent lifecycle starting from recording consent to withdrawal of the same within the systems and applications. \n- Data Lifecycle Management: Managing the personal data across its lifecycle starting from creation/collection to disposal and how it is carried out within the underlying systems and applications.\n- Disclosures: Measures towards limiting and safeguarding data disclosures to third party systems and vendors which are supporting the underlying systems and applications. \n- Security for Privacy: Technical and organizational measures towards safeguarding personal data processed by systems and applications.  \n- Individual Rights: Functionalities implemented within the systems and applications towards allowing the individuals to exercise their rights.\n- Privacy in System Development: Measures in place to ensure privacy considerations are factored in while developing/upgrading the systems and applications."]
[null,"What are the various sheets within the workbook?","Read this first: This sheet provides an overview of what the tool is all about and how it is meant to be used. It also provides additional information on domains covered and privacy by design principles. \nInitial Information Request: This sheet will have to be populated and this will provide an overview about the system/application. Based on responses to certain questions, controls that are applicable to the in-scope system/application may vary. \nAssessment : This sheet lists down 43 controls spread across seven domains that are to be tested for effectiveness from a Privacy by Design standpoint. Stakeholders should populate the columns 'Effectiveness Status' and 'Observation'. Upon clicking the 'Produce Report' Button that is placed at the end of the control listing, an automated PDF format report is generated using excel macros. "]
[null,"What are the various effectiveness levels?","There are four effectiveness levels for every control that are determined post testing the controls for their effectiveness. They are: \n- Effective: This control is implemented and operating effectively \n- Partially Effective: Some aspects of the control are implemented and operating effectively\n- Ineffective: The control is not implemented and is non existent\n- Not Applicable: The control is not applicable to the underlying systems and applications. "]
[null,"How to perform the assessment?","Step 1: Formation of Assessment Team\nTo initiate the assessment process, assemble a dedicated assessment team comprising members from the Privacy Team and system/application owners. This collaborative team will be responsible for conducting the assessment.\n\nStep 2: Initial Information Request\nThe assessor should begin by filling out the \"Initial Information Request\" sheet to identify the list of applicable controls. This step involves gathering essential information to kickstart the assessment process.\n\nStep 3: Evaluate Control Effectiveness and Populate Effectiveness Status\nThe assessor should inspect the effectiveness of controls, as outlined in the \"Assessment Sheet.\" In this step, the assessor examines each control's performance and how it aligns with established standards. Additionally, they should populate the \"Effectiveness Status\" column in the \"Assessment Sheet\" to document the assessment findings.\n\nStep 4: Review and Document Control Observations\nIn the \"Assessment Sheet,\" the assessor should focus on documenting their observations regarding control effectiveness. This involves populating the \"Observation\" column to provide detailed notes or comments based on their assessment of each control's performance. By concentrating on observations, this step helps create a comprehensive record of the assessment's outcomes without duplicating the evaluation of effectiveness status.\n\nStep 5: Generate PDF Report\nAfter evaluating control effectiveness and recording observations in the \"Assessment Sheet,\" the assessor should proceed to click on the button labeled 'Produce Report.' This action will trigger the system to generate a comprehensive PDF report summarizing the assessment results.\n\nStep 6: Review Recommendations\nIt's important to note that the recommendations generated by the tool are generic and based on industry best practices. The assessment team should carefully review these recommendations. They should consider tailoring the recommendations to align with the organization's specific environment and needs."]
[null,"Scoring Criteria and Calculation","In terms of scoring, controls categorized as 'Not Applicable' are excluded from the scoring calculation. Controls assessed as 'Partially Effective' receive a score of 1, while those rated as 'Effective' receive a score of 2. Controls assessed as 'Ineffective' receive a score of 0.\n\nTo calculate the overall Privacy by Design (PbD) tool score, we use the following formula:\n((Number of Effective Controls * 2) + Number of Partially Effective Controls * 1) / Total Number of Applicable Controls)) * 100\n\nThis formula provides a calibrated PbD tool score on a scale of 0 to 100, reflecting the effectiveness of controls applicable to the assessment. It considers fully effective, ineffective and partially effective controls while excluding those that are not applicable."]
[null," Macros","The tool has been developed using Macros, and it is essential to excercise prudence by adhering to your organization's policy on macros usage. \n\nEnabling macros can enhance functionality but also presents potential security risks. Be vigilant about the source of the file and ensure it comes from a trusted and reputable source.\n\nIf you have any concerns or questions about enabling macros or if your organization restricts macro usage, we strongly recommend contacting your IT administrator or IT security team for guidance. Your cybersecurity and data security are paramount, and following these steps responsibly is essential to protect your systems and data."]
[null,"Disclaimer","\nThe creators and providers of this tool, Qatar National Data Privacy Office (NDPO), disclaim any liability for the use or interpretation of this report and do not assume any responsibility for the consequences of decisions or actions taken based on the information contained herein. Organizations are ultimately responsible for their privacy practices and compliance efforts by regularly reviewing and updating relevant privacy policies and practices to maintain ongoing compliance.\n"]
[null,"Copyright and Licensing Information","Privacy by Design Assessment Tool © 2023 by National Data Privacy Office (NDPO) is licensed under Attribution-NonCommerical-NoDerivatives 4.0 International"]
[]
[]
[]
[]
[null,"Privacy by Design Principles"]
[null," Proactive not Reactive; Preventative not Remedial","The Privacy by Design approach should be proactive rather than reactive. "]
[null,"Privacy as the Default ","Privacy by Design seeks to deliver the maximum degree of privacy by ensuring that personal data are automatically protected in any given IT system or business practice. No action is required on the part of the individual to protect their privacy − it is built into the system, by default."]
[null,"Privacy Embedded into Design","Privacy by Design is embedded into the design and architecture of IT systems and business practices. It is not an afterthought. "]
[null,"Full Functionality; Positive-Sum, not Zero-Sum","Positive-Sum, not Zero-Sum: Privacy by Design seeks to accommodate all legitimate interests and objectives in a positive-sum “win win” manner, not through a zero-sum approach, where unnecessary trade-offs are made."]
[null,"End-to-End Security; Full Lifecycle Protection","Privacy by Design, extends securely throughout the entire lifecycle of the data involved — strong security measures are essential to privacy, from start to finish. All data are securely retained, and then securely destroyed at the end of the process, in a timely fashion. "]
[null,"Visibility and Transparency ; Keep it Open","Privacy by Design assures all stakeholders that processing activities are operating according to the stated promises and objectives. Its component parts and operations remain visible and transparent, to both users and providers alike. "]
[null,"Respect for User Privacy; Keep it User-Centric","Above all, Privacy by Design requires architects and operators to keep the interests of the individual uppermost by offering such measures as strong privacy defaults, appropriate privacy notices, and providing user-friendly choices to empower individuals. "]

{"sheet":"Initial Information Request","index":4,"n_rows":41,"n_cols":5,"rows_kept":41,"cut":false,"hidden":false,"merged":[[0,1,1,3]]}
[null,"Initial Information Request"]
[]
[]
[null,"S.No","Question/Information Request","Response"]
[null,1,"What is the name of the system/application? "]
[]
[null,2,"What is the name of the organization? "]
[]
[null,3,"Who is performing the Assessment? (Name and Designation)"]
[]
[null,4,"Date of performing the Assessment?"]
[]
[null,5,"Type of Application"]
[]
[null,5,"Does this system/application process personal data? "]
[]
[null,6,"Please provide us with the list of personal data attributes that is processed using the system/application?  ",null,".\n."]
[]
[null,7,"Is this system/application used by individuals(data subjects)? "]
[]
[null,8,"Who developed this system/application? ",null,".\n."]
[]
[null,9,"Please mention the list of upstream and downstream applications",null,".\n.\n.\n.\n.\n.\n.\n."]
[]
[null,10,"Who has access to personal data processed by the system/application? "]
[]
[null,11,"Please provide information on all personal data processing activities carried out by the application",null,".\n.\n.\n.\n.\n."]
[]
[null,12,"Does the application share data with external parties? "]
[]
[null,13,"If the answer to the above question is \"Yes\", please mention the list of external parties involved",null,".\n.\n.\n."]
[]
[null,14,"Where is the application hosted? "]
[]
[null,15,"What is the current rate of change/updates? "]
[]
[null,16,"What is the current architecture type? (e.g. Monolith, microservices, etc.)"]
[]
[null,17,"Does the application use secure socket layer certificate? Who is the issuing authority? "]
[]
[null,18,"What is the authentication method for users, components and other applications and services? "]

{"sheet":"Assessment","index":5,"n_rows":45,"n_cols":8,"rows_kept":45,"cut":false,"hidden":false,"merged":[]}
[" "]
[null,"Domain","Control ID","Control Title","Control Description","Privacy by Design Principle","Control Effectiveness","Observation"]
[null,"Transparency","TR_1","Privacy Notice","System/application should present the users (individuals) with a Privacy Notice at the time of collecting their personal data. ","Visibility and Transparency",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Transparency","TR_2","Privacy Notice - Contents","The privacy notice presented to users (individuals) should cover all aspects of personal data processing carried out by the system/application and should be in accordance with PDPPL requirements.  ","Visibility and Transparency",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Transparency","TR_3","Updated Privacy Notice ","Any changes to personal data processing shall be notified to the users (individuals) without undue delay through displaying an updated privacy notice.","Visibility and Transparency\nProactive not Reactive",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Transparency","TR_4","Updated Privacy Notice - Prompt","System/application should prompt the users (individuals) to view the updated Privacy Notice upon their first access (post publishing the updated notice). System/application may also be integrated with an email gateway to send email communications to individuals on updates to the Privacy Notice contents. ","Visibility and Transparency\nProactive not Reactive\nPrivacy embedded into Design",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Transparency","TR_5","Cookie Policy","Website should notify the users (individuals) on the use of cookies by displaying a cookie policy. The cookie policy should clearly describe the types of cookies collected (First Party, Third Party, Session Cookies, Persistent cookies) along with the rationale for collecting them. ","Visibility and Transparency",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Transparency","TR_6","Complaints Mechanism","System/application should provide users (individuals) with information about the complaints mechanism. ","Visibility and Transparency\nProactive not Reactive",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Consent Management","CM_1","Consent - Obtain","System/application should have the functionality to obtain the user's consent prior to collecting personal data.  \n\n//*applicable if consent is identified as the permitted reason/lawful basis for processing personal data*//","Privacy embedded into Design\nRespect for User Privacy",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Consent Management","CM_2","Consent - Record","System/application should have the functionality to maintain records the consent obtained from users (individuals). \n\n//*applicable if consent is identified as the permitted reason/lawful basis for processing personal data*//","Privacy embedded into Design\nRespect for User Privacy",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Consent Management","CM_3","Consent - Withdraw","System/application should provide the users (individuals) with an option to withdraw their consent. \n\n//*applicable if consent is identified as the permitted reason/lawful basis for processing personal data*//","Privacy embedded into Design\nRespect for User Privacy",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Consent Management","CM_4","Cookie Consent Banner","Upon a user's first access to a system/application, they should be presented with a cookie consent banner for managing their cookie preferences. Until a user chooses his/her cookie preferences, only necessary cookies required for functioning of the website should be used. \n\n//*applicable for web applications*//","Respect for User Privacy\nPrivacy as the Default\nPrivacy embedded into Design\nPositive Sum, not Zero Sum ",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Consent Management","CM_5","In-App permissions","All in-app permissions should be turned off by default. \n\n//*applicable for mobile apps*//","Respect for User Privacy\nPrivacy as the Default\nPrivacy embedded into Design",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_1","Records/Inventory","Records of Processing Activities/Personal data inventories should be developed for all personal data processing activities carried out using the system/application. ","Proactive not Reactive",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_2","Collection Limitation","System/application should limit the collection of personal data in such a manner that it is adequate, relevant and necessary to fulfil the stated purposes in the Privacy Notice. ","Proactive not Reactive\nPrivacy as the Default",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_3","Purpose Limitation","System/application should limit the processing of personal data to fulfil the purposes stated in the Privacy Notice. ","Proactive not Reactive\nPrivacy as the Default",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_4","Data Minimization","System/application should limit the use and processing of personal data in such a manner that it is adequate, relevant and necessary to fulfil the stated purposes in the Privacy Notice. ","Proactive not Reactive\nPrivacy as the Default",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_5","Data Accuracy","Appropriate measures should be in place to ensure personal data processed by the system/application are accurate and kept up-to date. ","Proactive not Reactive\nRespect for User Privacy\nPrivacy as the Default",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_6","Anonymization","Enable anonymization/de-identification on all instances of personal data, wherever, there is no requirement to maintain the same in clear text. ","Proactive not Reactive\nPrivacy as the Default Setting",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_7","Retention Period","Retention periods should be defined for all personal data that are processed using the system/application. ","Proactive not Reactive\nPrivacy as the Default",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Data Lifecycle Management","DLM_8","Retention Policy Enforcement","Retention policy should enforced on the system/application in accordance with the defined retention periods in such a manner that ensures personal data is disposed/anonymized post expiry of retention period. ","Proactive not Reactive\nPrivacy as the Default\nPrivacy Embedded into Design",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Disclosures","DIS_1","Data Processing Agreements","Data Processing Agreements (in accordance with PDPPL requirements) should be executed with all third parties that have access to personal data processed by the system/application.","Proactive not Reactive",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$29=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Disclosures","DIS_2","Notify individuals of disclosures","Individuals should be notified of all disclosures of personal data by third parties through the Privacy Notice. ","Visibility and Transparency\nProactive not Reactive",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$29=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Disclosures","DIS_3","Limit usage of Third Parties","Disclose personal data to third parties only for carrying out personal data processing activities that are stated in the Privacy Notice. ","Proactive not Reactive",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$29=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Disclosures","DIS_4","Limit disclosure of personal data attributes","Limit the disclosure of personal data attributes to third parties only to the extent it is necessary to fulfil the purposes stated in the Privacy Notice.","Proactive not Reactive\nPrivacy as the Default",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$29=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_1","Access controls","Appropriate levels of access controls should be in place to restrict access of personal data to authorized personnel. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_2","Audit Logging","Enable audit logging on system/application to keep a track of activities carried out by the Administrators and users. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_3","Data Backups","Critical data residing on the system/application should be backed up on a periodic basis. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_4","Web Application Firewall","System/Application should be protected with a Web Application Firewall (WAF) to protect the underlying application from malicious traffic. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_5","Security Alert - Login Attempt from new device","System/Application should be configured to send security alerts whenever the user attempts to login from a new device. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_6","Two Factor Authentication","Users are provided with an option to enable Two-Factor Authentication (2FA) for logging in to the system/application. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_7","Idle Session Timeout","User sessions should expire upon inactivity for a certain period of time. Criticality of the underlying system/application should be factored-in while setting the duration of idle session timeout. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_8","Incorrect Logon Attempts","System/Application should have a threshold of incorrect logon attempts. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_9","Password Policy","A strong password policy should be applied on the system/applications to safeguard from password attacks. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_10","Vulnerability Scanning","System/Applications should be subject to periodic vulnerability scans to unearth underlying vulnerabilities. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_11","Patching","All critical vulnerabilities should be patched without undue delay. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_12","Encryption at rest","Personal data stored in the underlying databases of systems/applications should be safeguarded with an appropriate level of encryption.","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Security for Privacy","SEC_13","Encryption in transit","All client server communications should be safeguarded with an appropriate level of encryption. ","Proactive not Reactive\nEnd to End Security",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Individual Rights","IR_1","Control to end users","System/application should present the end users with the functionality to access, update and delete their personal data. ","Proactive not Reactive\nPrivacy embedded into Design\nRespect for User Privacy",{"$f":"IF(OR('Initial Information Request'!$D$15=\"No\",'Initial Information Request'!$D$19=\"No\"),\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Individual Rights","IR_2","DSR - Access ","System/Application and the underlying databases should have the functionality to search and retrieve a copy of personal data of the requested user in a machine readable format.","Proactive not Reactive\nPrivacy embedded into Design\nRespect for User Privacy",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Individual Rights","IR_3","DSR - Correct ","System/Application and the underlying databases should have the functionality to search, update and amend the personal data of the requested user. ","Proactive not Reactive\nPrivacy embedded into Design\nRespect for User Privacy",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Individual Rights","IR_4","DSR - Delete","System/Application and the underlying databases should have the functionality to search and delete the personal data of the requested user. ","Proactive not Reactive\nPrivacy embedded into Design\nRespect for User Privacy",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Privacy in System Development","PSD_1","Privacy review and Approval - New system/application","Systems/applications should be subject to reviews and approvals from Privacy Team prior to their release. ","Privacy embedded into Design\nProactive not Reactive",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Privacy in System Development","PSD_2","Change Management","Integrate privacy considerations from the initial stages of system/application development and throughout the Software Development Lifecycle. ","Privacy embedded into Design\nProactive not Reactive",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]
[null,"Privacy in System Development","PSD_3","Testing","Production data (including personal data) should not be used for testing purposes.","Privacy embedded into Design\nProactive not Reactive",{"$f":"IF('Initial Information Request'!$D$15=\"No\",\"Not Applicable\",\"\")","v":""},"To be filled by the team carrying out the assessment"]

{"sheet":"Working Sheet","index":6,"n_rows":46,"n_cols":6,"rows_kept":46,"cut":false,"hidden":true,"merged":[]}
[]
[null,"Control Title","Control Description","Gap ","Gap Description","Recommendation"]
[null,"Privacy Notice","System/application should present the individuals with a Privacy Notice at the time of collecting their personal data","Privacy Notice","The system/application does not have the functionality in place to present the users (individuals) with a Privacy Notice at the time of collecting their personal data.","It is recommended to the perform the following: \n- Develop a Privacy Notice template to describe the processing of personal data by the system/application and in accordance with PDPPL and other applicable regulatory requirements.\n- Subject the Privacy Notice template to appropriate review mechanisms.\n- Publish the Privacy Notice on the system/application.\n- Identify all points of data collection within the system/application.\n- Present the users (individuals) with a Privacy Notice across all points of data collection. \n\nFor further reference:\nPrivacy Notice - Guideline for Regulated Entities"]
[null,"Privacy Notice - Contents","The privacy notice presented to individuals should cover all aspects of personal data processing carried out by the system/application and should be in accordance with applicable privacy ","Privacy Notice - Contents","There is no process in place to ensure Privacy Notice adheres with the requirements of PDPPL. ","It is recommended to the perform the following: \n- Develop a Privacy Notice template to describe the processing of personal data by the system/application and in accordance with PDPPL and other applicable regulatory requirements.\n- Subject the Privacy Notice template to appropriate review mechanisms.\n- Update the Privacy Notice template based on review comments.\n- Publish the Privacy Notice on the system/application. \n\nFor further reference:\nPrivacy Notice - Guideline for Regulated Entities"]
[null,"Updated Privacy Notice ","Any changes to personal data processing shall be notified to the individuals without undue delay with an updated privacy notice","Updated Privacy Notice ","There is no process in place to notify the individuals on changes in personal data processing activities via an updated Privacy Notice. ","It is recommended to the perform the following: \n- Update the existing Privacy Notice template to reflect the changes in personal data processing activities.\n- Subject the Privacy Notice template to appropriate review mechanisms and incorporate review comments.\n- Publish the updated Privacy Notice on the system/application. \n\nFor further reference:\nPrivacy Notice - Guideline for Regulated Entities"]
[null,"Updated Privacy Notice - Prompt","System/application should redirect the individuals to the updated Privacy Notice upon their first access post updating the Privacy Notice. System/application can also be integrated with an email gateway to send email communications to individuals on updates to the Privacy Notice contents. ","Updated Privacy Notice - Prompt","There is no process/functionality in place to either redirect the individuals to the updated Privacy Notice upon their first access post updating the Privacy Notice or send email communications to individuals on the updates made to the Privacy Notice.","It is recommended to perform the following: \nOption 1: Implement a functionality in such a manner that the system/application prompts the users (individuals) to review and accept the updated Privacy Notice through a privacy banner. \n                                              (AND/OR)\nOption 2: Send email communications to all registered users (individuals) on updates made to Privacy Notice contents either manually or via an email gateway. \n\nFor further reference:\nPrivacy Notice - Guideline for Regulated Entities"]
[null,"Cookie Policy","Website should notify the individuals on the usage of cookies through a cookie policy. The cookie policy should clearly describe the types of cookies collected (First Party, Third Party, Session Cookies, Persistent cookies) and the reasons for the same. ","Cookie Policy","There is no functionality in place to present the individuals with a Cookie Policy.","It is recommended to the perform the following: \n- Develop a Cookie Policy template to describe how the system/application uses cookies. \n- Subject the Cookie Policy template to appropriate review mechanisms and incorporate review comment.\n- Publish the Cookie policy on the system/application. \n\nGuidance on Cookie policy contents: \nIt is recommended to cover the following as part of the cookie policy: \n- What types of cookies do you use?\n- What personal data do the cookies process?\n- What are the purposes of these cookies?\n- How long will they track the individuals?\n- How can individuals opt-in or opt-out of cookie usage?"]
[null,"Complaints Mechanism","System/application should provide information about its complaints mechanism either in their privacy notice or via other means. ","Complaints Mechanism","The system/application does not provide information about its complaints mechanism.","It is recommended to perform the following:\n- Include a section on complaints mechanism with relevant contact details in the Privacy Notice.\n\n                                                       (OR) \n\n- Create a section within the system/application's user interface dedicated for complaints and include a category of privacy related complaints.\n- Establish a workflow in such a manner that complaints are forwarded to the privacy team's mail box if they fall under the category of \"Privacy\". \n\nFor further reference: \nIndividuals’ Complaints - Guideline for Regulated Entities"]
[null,"Consent - Obtain","System/application should have the functionality to obtain the individuals consent prior to collecting their personal data (applicable if consent is identified as the permitted reason/lawful basis for processing personal data) ","Consent - Obtain","System/application does not have the functionality to obtain consent from users (individuals)","It is recommended to perform the following: \n- At the time of registration or across all other points of data collection (if registration is not mandatory), present the users (individuals) with a consent statement which requires an opt-in from the them via a checkbox.  \n- The consent statement should reference the Privacy Notice and state that \"You agree to us processing your personal data in accordance with our Privacy Notice\" or have any other statement with the same intent. \n- Hyperlink the words \"Privacy Notice\" in consent statement with the URL of the applicable Privacy Notice.   "]
[null,"Consent - Record","System/application should have the functionality to record all consents obtained from the individuals (applicable if consent is identified as the permitted reason/lawful basis for processing personal data) ","Consent - Record","There is no functionality to record consent from individuals.","It is recommended to perform the following: \n-  Implement a functionality to capture the timestamp of consent provided by the users (individuals) by integrating the system/application with a third party consent manager or via any other means (such as capturing the consent event by creating a digital record in the audit trial)."]
[null,"Consent - Withdraw","System/application should provide the individuals with the functionality to withdraw consent (applicable if consent is identified as the permitted reason/lawful basis for processing personal data) ","Consent - Withdraw","There is no functionality that allows individuals to withdraw their consent.","It is recommended to perform the following: \n- Provide individuals an opt out link to withdraw consent within the system/application. Post clicking on the opt-out link, update the consent status of the user (individual) and cease processing of personal data. \n                                                       (OR)\n- Notify users (individuals) on the means to withdraw consent in the Privacy Notice by providing relevant contact details for exercising the same.\n- Upon receiving such a request, update the consent status of the requested user (individual) and cease processing of personal data. "]
[null,"Cookie Consent Banner","Upon an individual's first access to a system/application, they should be presented individuals with a cookie consent banner for managing their cookie preferences. Until an individual chooses his/her cookie preferences, only necessary cookies required for functioning of the website should be used. ","Cookie Consent Banner","There is no functionality to present individuals with a cookie consent banner upon their first access. ","It is recommended to perform the following:\n- Implement a functionality to present the users (individuals) with a cookie consent banner and prompt the individual to select their cookie preferences on their first access. \n- Ensure that the web application stores only necessary cookies on the individuals device (and not other types of cookies), prior to obtaining consent."]
[null,"In-App permissions","All in-app permissions should be turned off by default. (applicable for mobile apps)","In-App permissions","In-App permission are not turned off by default. ","It is recommended that all in-app permissions remain turned off by default and request the user (individual) for permission prior to accessing/using the relevant system resource (such as location, photos, camera, etc.). "]
[null,"Records/Inventory","Records/Personal data inventories shall be developed for all personal data processing activities carried out using the system/application. ","Records/Inventory","Personal data inventories are not developed for processing activities carried out using the system/application. ","It is recommended to perform the following:\n- Identify all processing activities carried out using the system/application.\n- Develop a Record of all the identified processing activities by inventorizing all personal data attributes processed by the system.\n- Review and update the Records of processing activity on a periodic basis. \n\nFor further reference:\nRecord of Processing Activities - Guideline for Regulated Entities"]
[null,"Collection Limitation","System/application should limit the collection of personal data in such a manner that it is adequate, relevant and necessary to fulfil the stated purposes in the Privacy Notice. ","Collection Limitation","There are no checks in place to limit the collection of personal data to what is adequate, relevant and necessary. ","It is recommended to perform the following:\n- Identify all  processing activities that are carried out using the system/application.\n- Review if the processing activities are in accordance with the privacy notice and cease those processing activities which are not listed in the Privacy Notice.\n- Identify all personal data attributes that are captured by the system/application.\n- Review if the personal data fields that are captured by the system/application are necessary for the processing activities and remove any excessive data fields.\n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Purpose Limitation","System/application should limit the processing of personal data to fulfil the purposes stated in the Privacy Notice. ","Purpose Limitation","There are no checks in place to limit the collection of personal data. ","It is recommended to perform the following:\n- Identify all  processing activities that are carried out using the system/application.\n- Review if the processing activities are in accordance with the privacy notice and cease those processing activities which are not listed in the Privacy Notice.\n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Data Minimization","System/application should limit the use and processing of personal data in such a manner that it is adequate, relevant and necessary to fulfil the stated purposes in the Privacy Notice. ","Data Minimization","There is no process in place that limits the usage of personal data to what is adequate, relevant and necessary. ","It is recommended to perform the following:\n- During the design stage of the system/application, identify all proposed processing activities that may be carried out using the same.\n- Identify only those personal data attributes that are necessary for carrying out the proposed processing activities.\n- Obtain a buy-in from the privacy team for using the identified personal data attributes for the proposed activities.\n- Ensure that the system processes only requisite personal data attributes for carrying out the approved processing activities. \n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Data Accuracy","Appropriate measures should be in place to ensure personal data processed by the product are accurate and kept up-to date. ","Data Accuracy","There are no measures in place to ensure accuracy of personal data is maintained. ","It is recommended to perform the following:\n- Provide a functionality for the individuals to review and update their personal information.\n- Send a periodic reminder to the individuals to review and update their personal data. \n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Anonymization","Enable anonymization/de-identification on all instances of personal data, wherever, there is no requirement to maintain the same in clear text. ","Anonymization","Anonymization/de-identification is not performed. ","It is recommended to perform the following:\n- Privacy Office along with relevant stakeholders (eg. owners and users of Applications and Systems, BU Heads) should determine if there are any use cases for Anonymization/De-identification of personal data contained in the application/system.\n- Upon identification of use cases, relevant technique for data anonymization (such as Data Masking, Generalization, Data swapping, Data perturbation, etc.) should be identified\n- Perform data anonymization in accordance with technique identified.\n- Perform periodic reviews to inspect if the anonymization technique is implemented adequately. "]
[null,"Retention Period","Retention periods should be defined for all personal data that are processed using the system/application. ","Retention Period","Retention periods are not defined for personal data processed using the system/application.","It is recommended to perform the following: \n- Identify all personal data processed by the application/system.\n- Identify and finalize the retention period for each of the personal data attribute processed by the application/system depending on business requirement and/or legal requirement. Factors such as data sensitivity, industry specific regulations and contractual obligations should be factored in.  \n- Retention periods identified should be defined and documented in a retention schedule. \n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Retention Policy Enforcement","Retention policy should enforced on the system/application in accordance with the defined retention periods. ","Retention Policy Enforcement","Retention policy is not enforced on the system/application. ","It is recommended to perform the following: \n- Develop a well-defined retention policy framework that outlines the retention periods, procedures, and responsibilities for enforcing data retention within the system/application. This policy should be documented, communicated to relevant stakeholders, and periodically reviewed and updated to reflect changing regulations or business needs.\n- Implement technical controls within the system/application to enforce the defined retention periods. This may involve configuring automated mechanisms, such as data archiving, backup systems, or data lifecycle management tools, that can facilitate the timely deletion of data based on the established retention policies.\n- Privacy Office along with Internal Audit Team should periodically monitor compliance of the application/system to the retention policy. \n\nFor further reference: \nPrinciples of Data Privacy - Guideline for Regulated Entities"]
[null,"Data Processing Agreements","Data Processing Agreements (in accordance with PDPPL requirements) should be executed with all third parties that have access to personal data processed by the system/application.","Data Processing Agreements","There are no Data Processing Agreements executed with Third Party processors have access to personal data processed by system/application. "," It is recommended to perform the following:\n- Identify all Third Parties that may have access to personal data processed by the system/application.\n- Review the existing contractual agreements with the identified Third Parties (in Step 1), to evaluate if they contain relevant Privacy and Data Protection Clauses in accordance with PDPPL agreements and identify the contracts which do not contain adequate provisions.\n- Update the contractual agreements which do not contain adequate provisions from a Privacy and Data Protection standpoint by ensuring clauses around the following are included: \na) Purpose and scope of processing\nb) Data Processing Instructions \nc) Data Protection and Security measures\nd) Sub processing. \n\nFor further reference: \nController and Processor - Guideline for Regulated Entities"]
[null,"Notify individuals of disclosures","Individuals should be notified of all disclosures of personal data by Third Parties through the Privacy Notice. ","Notify individuals of disclosures","There is no process to notifies users on the disclosure of their personal data to third parties. "," It is recommended to perform the following:\n- Identify all Third Parties that may have access to personal data processed by the system/application.\n- Update that the Privacy Notice (linked to the system/application) with the list of Third Parties which may have access to personal data processed by system/application. "]
[null,"Limit usage of Third Parties","Disclose personal data to third parties only for carrying out personal data processing activities that are stated in the Privacy Notice. ","Limit usage of Third Parties","There is no process to ensure personal data is disclosed to third parties only for carrying out personal data processing activities stated in the Privacy Notice. ","It is recommended to perform the following: \n- Identify all personal data processing activities (using the system/application) carried out by the Third Parties. \n- Verify if the identified processing activities falls within the processing activities stated in the Privacy Notice. "]
[null,"Limit disclosure of personal data attributes","Limit the disclosure of personal data attributes to third parties only to the extent it is necessary to fulfil the purposes stated in the Privacy Notice.","Limit disclosure of personal data attributes","There is no process to limit the disclosure of personal data attributes to what is necessary. ","It is recommended to perform the following:\n- Identify all personal data processing activities (using the system/application) carried out by the vendors and the purpose for carrying out the same.\n- Identify the personal data attributes disclosed to the vendor for fulfilling the purpose for which they are carrying out personal data processing activities.\n- Assess the necessity for disclosure of every single personal data attribute and identify redundant personal data disclosures.\n- Restrict the disclosure to only those attributes that are necessary by removing all redundant personal data disclosures. "]
[null,"Deletion of personal data from Third Party systems","Ensure personal data is deleted from the Third Party service providers system post expiry of the service agreement. ","Filler","Filler","Filler"]
[null,"Access controls","Appropriate levels of access controls should be in place to restrict access of personal data to authorized personnel. ","Access controls","There is no process that restricts data access only to authorized personnel","It is recommended to perform the following:\n-  Leverage RBAC principles to define roles and associated access privileges within the application and identify the different roles that require access to personal data. \n- Assign access permissions to each role based on their job responsibilities and the principle of least privilege.\n- Implement robust user authentication mechanisms to verify the identity and authorization of users accessing the application."]
[null,"Audit Logging","Enable audit logging on system/application to keep a track of activities carried out the Administrators and individuals. ","Audit Logging","Audit logging is not enabled on the system/application. ","It is recommended to perform the following:\n- Identify and finalize the specific activities and events that need to be logged such as user logins, data access, modifications, configuration changes, failed login attempts, and administrative actions.\n- Design the logging system to capture relevant information (timestamp of the event, user ID, the IP address or device identifier, the action performed, etc.) about each logged event. \n- Securely store the logs (for a defined time period) to safeguard them from unauthorized access, tampering, or deletion. \n- Regularly review and analyze the audit logs to identify any suspicious activities and anomalies. "]
[null,"Data Backups","Critical data residing on the system/application should be backed up on a periodic basis. ","Data Backups","Critical data residing on the system/application is not backed up. ","It is recommended to perform the following:\n- Identify and finalize the following factors with regards to data back ups:\ni) critical data that is required to be backed up.\nii)  frequency of backups \niii) reliable and secure backup storage location \niv) backup method to be used\nv) appropriate backup tools or software.\n- Backup the data based on the above finalized factors. "]
[null,"Web Application Firewall","System/Application should be protected with a Web Application Firewall to protect the underlying application from malicious traffic. ","Web Application Firewall","Web Application Firewall is not installed to protect the system/application from malicious traffic.  ","It is recommended to perform the following:\n- Identify and finalize a suitable WAF solution that meets the security requirements of the system/application.\n- Finalize on the deployment mode of WAF (Cloud based WAF and On-premises WAF).\n- Customize the WAF rules based on the analysis to protect against common web application attacks such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), etc."]
[null,"Security Alert - Login Attempt from new device","System/Application should be configured to send security alerts whenever the individual attempts to login from a new device. ","Security Alert - Login Attempt from new device","System/Application is not configured to send security alerts whenever the individual attempts to login from a new device. ","It is recommended to perform the following:\n- Define the criteria for new device login such as a new IP address, or a new user agent. \n- Implement a security alerting system that can monitor login activities and trigger alerts to the users when a new device login is detected basis defined criteria for new device logins."]
[null,"Two Factor Authentication","individuals are provided with an option to enable Two-Factor Authentication (2FA) for logging in to the system/application. ","Two Factor Authentication","Two Factor Authentication is not implemented. ","It is recommended to perform the following:\n- Select and finalize two methods of authentication (something you know, something you have and something you have).\n- Integrate the finalized authentication methods with the existing mechanism that allows users to authenticate their identity for accessing the system/application.\n- Notify users about the 2FA methods with clear instructions on how to enroll and gain access to the system/application.  "]
[null,"Idle Session Timeout","individual sessions should expire upon inactivity for a certain period of time. Criticality of the underlying system/application should be factored-in while setting the duration of idle session timeout. ","Idle Session Timeout","Sessions do not expire upon inactivity for a certain period of time. ","It is recommended to perform the following:\n- Define a session timeout policy for the system/application depending on its criticality (idle time session time out must be low for critical systems/applications and high for lesser critical systems/applications).\n-  Implement a mechanism to track user activity and update the session status via running server side tracking or client side scripts. \n- Implement a mechanism to log out the user from the system/application in accordance with the session timeout policy. "]
[null,"Incorrect Logon Attempts","System/Application should have a threshold of incorrect logon attempts. ","Incorrect Logon Attempts","Users/non users are able to attempt to log on to an account for an unlimited number of times, making it more possible for non-users to guess password","It is recommended to perform the following:\n- Define a threshold value for the number of incorrect logon attempts depending on the criticality of system/application.\n- Define the account lockout policy in such a manner that it locks out the user's account temporarily for a specific duration or indefinitely until intervention by an administrator.\n- Implement the account lockout policy on the system/application accordingly. "]
[null,"Password Policy","A strong password policy should be enforced to prevent the underlying system/applications from password attacks. ","Password Policy","A strong password policy is not enforced on the system/application. ","It is recommended to perform the following:\n- Define a password policy depending on the criticality of the application (with strength of policy proportional to the criticality of the application) by factoring various parameters such as password length, password complexity, password history, password expiry, etc. \n- Implement password validation logic to check if a new or changed password meets the defined requirements and ensure passwords are stored in a hashed and salted format in the database. \n- Implement a secure password recovery process, such as sending password reset links via email or SMS. "]
[null,"Vulnerability Scanning","System/Applications should be subject to periodic vulnerability scans to unearth underlying vulnerabilities. ","Vulnerability Scanning","Vulnerability scans are not regularly carried out to assess the state of security for the application. ","It is recommended to perform the following:\n- Identify all system/application components which requires to be subject to vulnerability scans.\n- Subject the system/application components to internal and external vulnerability scans to unearth underlying vulnerabilities."]
[null,"Patching","All critical vulnerabilities should be patched without undue delay. ","Patching","Critical vulnerabilities are not patched without undue delay. ","It is recommended to perform the following:\n- Implement a process for prioritizing vulnerabilities that require patching basis their severity.\n- Implement a centralized patch management system that performs timely patching of critical vulnerabilities across all systems and applications.\n- Perform a periodic review to ensure all critical vulnerabilities are patched accordingly. "]
[null,"Encryption at rest","Personal data stored in the underlying Databases of systems/applications should be safeguarded with an appropriate level of encryption.","Encryption at rest","Data residing within the databases of system/application are not encrypted. ","It is recommended to perform the following:\n- Identify and finalize strong and secure encryption algorithm with sufficient key length for data at rest.\n- Establish a secure key management system to generate, store, and manage encryption keys.\n- Apply either table level encryption or column level encryption depending on the sensitivity of underlying data. "]
[null,"Encryption in transit","All client server communications should be safeguarded with an appropriate level of encryption. ","Encryption in transit","Data transfers from/to system/application are not encrypted. ","It is recommended to perform the following:\n- Identify and finalize strong asymmetric encryption algorithm for safeguarding data in transit.\n- Establish a secure key management system to generate, store, and manage encryption keys.\n- Enable SSL/TLS (Secure Sockets Layer/Transport Layer Security) to encrypt all data transmitted between the client and server."]
[null,"Control to end users","System/application should present the end users with the functionality to access, update and delete their personal data. ","Control to end users","End users are not presented with the functionality to access, update and delete their personal data. ","It is recommended to perform the following:\n- Present the users with a dashboard that allows individuals to access and manage their personal data.\n- Access:  Develop requisite functionalities that allows users to view their data in a machine readable format using the dashboard created.\n- Update: Develop requisite functionalities that allows users to update their data via the user dashboard and implement data validation checks to preserve data accuracy and prevent erroneous data entries. \n- Delete: Develop requisite functionalities that allows users to delete their data via the user dashboard.\n\nFor further reference: \nIndividuals’ Rights - Guidelines for Regulated Entities"]
[null,"DSR - Access ","System/Application and the underlying databases should have the functionality to search and retrieve a copy of personal data of the requested individual in a machine readable format. ","DSR - Access ","System/Application and the underlying databases do not have the functionality to search and retrieve a copy of personal data. ","It is recommended to perform the following:\n- Develop a data search mechanism that allows for the requested individual's data to be located within the system/application and it's underlying databases.\n- Upon locating the requested data,  retrieve and convert the same to machine-readable format.\n\nFor further reference: \nIndividuals’ Rights - Guidelines for Regulated Entities"]
[null,"DSR - Correct ","System/Application and the underlying databases should have the functionality to search, update and amend the personal data of the requested individual. ","DSR - Correct ","System/Application and the underlying databases do not have the functionality to search, update and amend personal data. ","It is recommended to perform the following:\n- Develop a data search mechanism that allows for all the instances of requested individual's data to be located within the system/application and it's underlying databases.\n- Upon locating the requested data, amend all instances of the data as per the request received.  \n\nFor further reference: \nIndividuals’ Rights - Guidelines for Regulated Entities"]
[null,"DSR - Delete","System/Application and the underlying databases should have the functionality to search and delete the personal data of the requested individual. ","DSR - Delete","System/Application and the underlying databases do not have the functionality to search and delete personal data. ","It is recommended to perform the following:\n- Develop a data search mechanism that allows for all the instances of requested individual's data to be located within the system/application and it's underlying databases.\n- Upon locating the requested data,  delete all instances of the data as per the request received.  \n\nFor further reference:\nIndividuals’ Rights - Guidelines for Regulated Entities"]
[null,"Privacy review and Approval - New system/application","Systems/applications should be subject to Privacy reviews and approvals from Privacy Team prior to its release. ","Privacy review and Approval - New system/application","System/application are not subject to  Privacy reviews and approvals from Privacy Team prior to their release. ","It is recommended to perform the following:\n- Develop a clear and standardized privacy review process that outlines the steps and requirements for conducting privacy assessments before any system/application release.\n- Identify underlying risks in the systems/applications through carrying out a Data Protection Impact Assessment.\n- Implement requisite controls to minimize the identified risks.\n- Post taking measures to mitigate the identified risks, circulate the same to Privacy Office and obtain their buy-in/approval on the system/application. \n\nFor further reference: \nData Privacy Impact Assessment (DPIA) - Guideline for Regulated Entities"]
[null,"Change Management","Integrate privacy considerations from the initial stages of system/application development and throughout the Software Development Lifecycle.","Change Management","Privacy considerations are not factored in Software Development Lifecycle.","It is recommended to perform the following:\n- Involve Privacy Office in the early stages of system/application development lifecycle and obtain their inputs with regards to identifying potential privacy risks and designing appropriate mitigation controls.\n- Conduct Data Privacy Impact Assessments (DPIAs) at the design phase to identify and evaluate privacy risks.\n- Include privacy requirements as part of the project's functional and technical specifications and track the implementation of the same. "]
[null,"Testing","Production data (including personal data) should not be used for testing purposes.","Testing","There is no process to ensure production data are not used for testing purposes. ","It is recommended to perform the following: \n- Finalize the data set that is going to be subject to testing purpose and identify all personal identifiers contained in the same. \n- Prior using the dataset for testing, ensure that all personal data identifiers are removed or replaced with synthetic data. "]

{"sheet":"Calculations","index":7,"n_rows":82,"n_cols":10,"rows_kept":82,"cut":false,"hidden":true,"merged":[]}
[]
[null,"Control Status","Count"]
[null,"Effective",{"$f":"COUNTIF(Assessment!G:G,Calculations!B3)","v":0}]
[null,"Ineffective",{"$f":"COUNTIF(Assessment!G:G,Calculations!B4)","v":0}]
[null,"Partially Effective",{"$f":"COUNTIF(Assessment!G:G,Calculations!B5)","v":0}]
[null,"Not Applicable",{"$f":"COUNTIF(Assessment!G:G,Calculations!B6)","v":0}]
[]
[null,null,{"$f":"(C3*2+C5*1)/((SUM(C3:C6)-C6)*2)","v":{"$error":"#DIV/0!"}}]
[null,"Privacy Score",{"$f":"IFERROR((C3*2+C5*1)/((SUM(C3:C6)-C6)*2),\"\")","v":""},null,"Domain wise status","Count","Effective","Ineffective","Partially Effective","Not Applicable"]
[null,null,null,null,"Transparency",{"$f":"COUNTIF(Assessment!B:B,Calculations!E10)","v":6},{"$f":"COUNTIF(Assessment!$G$3:$G$8,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$3:$G$8,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$3:$G$8,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$3:$G$8,Calculations!J9)","v":0}]
[null,null,{"$f":"IFERROR((ROUND(C9*100,2)), \"\")","v":""},null,"Consent Management",{"$f":"COUNTIF(Assessment!B:B,Calculations!E11)","v":5},{"$f":"COUNTIF(Assessment!$G$9:$G$13,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$9:$G$13,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$9:$G$13,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$9:$G$13,Calculations!J9)","v":0}]
[null,null,{"$f":"_xlfn.CONCAT(C11, \" out of 100\")","v":" out of 100"},null,"Data Lifecycle Management",{"$f":"COUNTIF(Assessment!B:B,Calculations!E12)","v":8},{"$f":"COUNTIF(Assessment!$G$14:$G$21,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$14:$G$21,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$14:$G$21,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$14:$G$21,Calculations!J9)","v":0}]
[null,null,null,null,"Disclosures",{"$f":"COUNTIF(Assessment!B:B,Calculations!E13)","v":4},{"$f":"COUNTIF(Assessment!$G$22:$G$25,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$22:$G$25,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$22:$G$25,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$22:$G$25,Calculations!J9)","v":0}]
[null,null,"PbD Score: ",null,"Security for Privacy",{"$f":"COUNTIF(Assessment!B:B,Calculations!E14)","v":13},{"$f":"COUNTIF(Assessment!$G$26:$G$38,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$26:$G$38,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$26:$G$38,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$26:$G$38,Calculations!J9)","v":0}]
[null,null,null,null,"Data Subject Rights",{"$f":"COUNTIF(Assessment!B:B,Calculations!E15)","v":0},{"$f":"COUNTIF(Assessment!$G$39:$G$42,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$39:$G$42,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$39:$G$42,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$39:$G$42,Calculations!J9)","v":0}]
[null,null,{"$f":"IF(ISERROR(C8),\"Controls are not Applicable\", _xlfn.CONCAT(C14,C12))","v":"Controls are not Applicable"},null,"Privacy in System Development",{"$f":"COUNTIF(Assessment!B:B,Calculations!E16)","v":3},{"$f":"COUNTIF(Assessment!$G$43:$G$45,Calculations!G9)","v":0},{"$f":"COUNTIF(Assessment!$G$43:$G$45,Calculations!H9)","v":0},{"$f":"COUNTIF(Assessment!$G$43:$G$45,Calculations!I9)","v":0},{"$f":"COUNTIF(Assessment!$G$43:$G$45,Calculations!J9)","v":0}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,1,"G_01"]
[null,null,null,null,2,"G_02"]
[null,null,null,null,3,"G_03"]
[null,null,null,null,4,"G_04"]
[null,null,null,null,5,"G_05"]
[null,null,null,null,6,"G_06"]
[null,null,null,null,7,"G_07"]
[null,null,null,null,8,"G_08"]
[null,null,null,null,9,"G_09"]
[null,null,null,null,10,"G_10"]
[null,null,null,null,11,"G_11"]
[null,null,null,null,12,"G_12"]
[null,null,null,null,13,"G_13"]
[null,null,null,null,14,"G_14"]
[null,null,null,null,15,"G_15"]
[null,null,null,null,16,"G_16"]
[null,null,null,null,17,"G_17"]
[null,null,null,null,18,"G_18"]
[null,null,null,null,19,"G_19"]
[null,null,null,null,20,"G_20"]
[null,null,null,null,21,"G_21"]
[null,null,null,null,22,"G_22"]
[null,null,null,null,23,"G_23"]
[null,null,null,null,24,"G_24"]
[null,null,null,null,25,"G_25"]
[null,null,null,null,26,"G_26"]
[null,null,null,null,27,"G_27"]
[null,null,null,null,28,"G_28"]
[null,null,null,null,29,"G_29"]
[null,null,null,null,30,"G_30"]
[null,null,null,null,31,"G_31"]
[null,null,null,null,32,"G_32"]
[null,null,null,null,33,"G_33"]
[null,null,null,null,34,"G_34"]
[null,null,null,null,35,"G_35"]
[null,null,null,null,36,"G_36"]
[null,null,null,null,37,"G_37"]
[null,null,null,null,38,"G_38"]
[null,null,null,null,39,"G_39"]
[null,null,null,null,40,"G_40"]
[null,null,null,null,41,"G_41"]
[null,null,null,null,42,"G_42"]
[null,null,null,null,43,"G_43"]
[null,null,null,null,44,"G_44"]
[null,null,null,null,45,"G_45"]
[null,null,null,null,46,"G_46"]
[null,null,null,null,47,"G_47"]
[null,null,null,null,48,"G_48"]
[null,null,null,null,49,"G_49"]