Paperwork, already half done

DPIA starter: Afi

from trust card 3 answers · you answer 6 left

1. What personal data does the tool process, and where?
   from trust card · maker says Copies of your mailboxes and files, encrypted (AES-256 at rest; you can bring your own key). Afi staff and contractors don’t have access to backup data.
2. Where does processing happen?
   from trust card · maker says You choose: USA, Canada, Europe (Netherlands), Germany, Switzerland, the United Kingdom or Australia. Multi-geo tenants can map each geography to its own region.
3. Who else receives the data (sub-processors)?
   you answer
4. How long is it kept?
   from trust card · maker says Immutable backup format; optional retention lock of about a month that no party, Afi included, can override.
5. The supplier’s role under UK GDPR
   you answer
6. Why do you need this processing?
   you answer
7. Who are the data subjects?
   you answer
8. Main risks, and what reduces them
   you answer
9. Residual risk after controls
   you answer