Processors' Self-Assessment Questionnaire (SA-2)

Summary

This is a self-assessment questionnaire template (SA-2) published by the Guernsey Office of the Data Protection Authority to help organisations acting as data processors under the Data Protection (Bailiwick of Guernsey) Law, 2017 review their own compliance. It is explicitly stated to be guidance only, not legal advice, and is intended as an internal working tool rather than a document to be filed with the regulator.

• Data collection: Prompts on what personal data and special category data are processed and for what purposes
• Governance: Questions on appointment and role of a Data Protection Officer and on written processing agreements with controllers
• Storage and archiving: Questions on where and how personal data is stored, including use of third parties
• Security: Questions on access controls, breach detection and breach reporting procedures to controllers
• Destruction and termination: Questions on data destruction responsibilities and end-of-contract data handling
• Sub-processors: Questions on authorisation, agreements and security requirements for any sub-processors used
• Transfers: Questions on cross-departmental and international transfers of personal data, including transfers outside the EEA
• Training: Questions on staff training and awareness of data protection obligations

The document notes in passing that processors must have written authorisation from controllers before engaging sub-processors, must maintain records of processing activities, and must notify controllers promptly of any data breaches, but it does not itself impose new legal duties beyond restating requirements of the underlying Law; it is a self-assessment aid rather than a binding rule or reporting form with a deadline.

Applies to

data processors