Template
Data protection self-assessment
For a team to review the GDPR basics without feeling tested: answers are anonymous and, on submitting, everyone sees their score and the explanation of each question with its article. In the summary you see which concepts are hardest, to reinforce them in the next session.
Who it's for: Data protection officers, compliance leads and teams.
No card · Opens already built in your editor
-
How long is there to reply to someone asking for access to their data? *Ten daysOne monthThree months
-
Can an IP address be personal data? *YesNo
-
Which principle requires asking only for the data needed? *Data minimisationAccuracyStorage limitation
-
Within how many hours must a data breach be notified to the supervisory authority? *
-
Which are lawful bases for processing data? (tick all) *ConsentLegitimate interestsCuriosity +1
When to use it
- You want your team to review the GDPR basics.
- You'd rather nobody feels tested: answers are anonymous.
- You want to know which concepts to reinforce in the next session.
What's inside and why
- How long is there to reply to someone asking for access to their data?
- A deadline that's often forgotten; the explanation cites the article.
- Which are lawful bases for processing data?
- Several answers: all the valid ones must be recognised and the one that isn't left out.
Tips to get the most out of it
- Keep the answers anonymous: people answer more honestly when there's no named score.
- Share the summary with the team: seeing which question was hardest starts the conversation.
- Repeat it a few months later to see if it improves.
Frequently asked questions
Can people see the correct answers before submitting?
No: the correct answers and explanations don't leave the server until the form is submitted; they're not even in the page's code.
Can I change a correct answer afterwards?
Yes: if you marked the wrong one, fix it in the editor and the scores are recalculated in the summary, the CSV and the certificates.
Can someone take it twice?
By default yes, like any form. If you don't want that, limit it to one response per device in the settings, or ask for the email and check the CSV.