01Synthetic / illustrative

Sample risk-ranked findings register.

A fictional excerpt showing how assessment observations, mapped controls, actions, and ownership can be presented for decision-making.

Fictional organization Munawara Travel Est. — a fictional Jeddah-based Umrah services company

Illustrative review scope Two fictional data flows across four operational evidence domains

Sample-data boundary No real company, client, production, or personal data

1 critical 3 high 2 medium 1 low 1 informational

02Findings excerpt

Evidence state before interpretation.

Entries are ordered by illustrative risk priority. A control reference is a mapping aid, not a legal conclusion.

Finding ID

F-01

Critical Not evidenced

72-hour breach workflow

No approved decision and escalation workflow was supplied for starting, owning, and evidencing the 72-hour notification clock.

PDPL-mapped control reference: PDPL Article 20 · Implementing Regulation Article 24
Recommended action: Approve a trigger-to-decision playbook with named incident roles, a decision log, escalation thresholds, and time-stamped notification evidence; then run a tabletop exercise.
Suggested owner: DPO with Information Security lead

Finding ID

F-02

High Not evidenced

Data-subject-request handling

The intake mailbox is described, but no central request log, identity-verification record, deadline control, or closure evidence was supplied.

PDPL-mapped control reference: PDPL Articles 4 and 21 · Implementing Regulation Articles 3–10, as applicable
Recommended action: Create one request register with intake date, verified requester, right exercised, assigned owner, due date, decision, fulfillment evidence, and approved exception rationale.
Suggested owner: Privacy Operations lead

Finding ID

F-03

High Partially evidenced

Marketing consent

Sample opt-in exports contain a contact and timestamp, but do not retain the purpose, channel, notice version, consent language, or capture source.

PDPL-mapped control reference: PDPL Articles 5, 25, and 26 · Implementing Regulation Article 11
Recommended action: Define a consent evidence schema and migrate active marketing records so each message can be traced to a specific purpose, channel, notice, wording, source, and timestamp.
Suggested owner: CRM Product owner with DPO review

Finding ID

F-04

High Partially evidenced

DPO accountability

A DPO appointment letter was supplied, but delegated authority, conflict escalation, control-owner reporting, and management-review cadence are not documented.

PDPL-mapped control reference: PDPL Article 30 · Implementing Regulation Article 32
Recommended action: Approve a DPO responsibility and escalation charter, identify operational control owners, and establish a documented quarterly management review.
Suggested owner: General Manager

Finding ID

F-05

Medium Not evidenced

Marketing consent

No evidence was supplied that opt-outs are reconciled across the CRM, SMS provider, email platform, and manually maintained campaign lists.

PDPL-mapped control reference: PDPL Articles 5, 25, and 26 · Implementing Regulation Article 12
Recommended action: Establish one suppression source of truth, define propagation times for every channel, and retain recurring reconciliation and exception evidence.
Suggested owner: Head of Marketing Operations

Finding ID

F-06

Medium Partially evidenced

72-hour breach workflow

A breach-register template exists, but no completed drill record demonstrates clock initiation, notification assessment, approvals, or evidence preservation.

PDPL-mapped control reference: PDPL Article 20 · Implementing Regulation Article 24
Recommended action: Run a time-boxed scenario, complete the register end to end, record notification decisions and approvals, and log actions arising from the exercise.
Suggested owner: Information Security lead

Finding ID

F-07

Low Evidenced

Data-subject-request handling

A dedicated request channel and matching privacy-notice instructions were observed; the evidence set does not yet include a scheduled owner review for keeping both current.

PDPL-mapped control reference: PDPL Articles 4 and 21 · Implementing Regulation Articles 3 and 10
Recommended action: Assign a quarterly check of channel availability, notice wording, ownership, and routing, with a dated review record.
Suggested owner: Customer Care manager

Finding ID

F-08

Informational Out of scope

DPO accountability

The legal sufficiency of the DPO appointment and the appointee’s qualifications were not assessed; review was limited to supplied operational accountability evidence.

PDPL-mapped control reference: PDPL Article 30 · Implementing Regulation Article 32; mapping shown for orientation only
Recommended action: Obtain separate qualified advice on appointment applicability, independence, and qualifications if management requires a legal-position review.
Suggested owner: General Manager with qualified counsel

This sample demonstrates an assessment output format. The fictional observations were invented for illustration, the evidence states do not describe any real organization, and the control mappings should be validated against the facts and applicable requirements of a real engagement.

See the assessment scope before you book.

Review scope & fee → Preview the executive readout →