Identify the movement of personal data in the organization

Identify the legal basis

Keep records of personal data processing activities if applicable

Determine a personal data protection officer

Policy/Reporting/Privacy Statement

Consider personal data protection rights

Assess the impact on personal data protection

Make a plan with a scenario that violates the security of personal data

Apply appropriate technical and organisational measures

Statements of secrecy/confidentiality