Skip to content
← All pathways

Guided journey

Clinic, hospital or health app

Patient data is sensitive data, the breach clock is 24 hours, and a DPIA is mandatory. Let's make sure patient data cannot sink you.

19 steps about 208 minutes in totalFree · no account needed to run a step

  1. 1

    POTRAZ Tier & DPO Checker

    required· ~5 min

    Run this on its own
  2. 2

    Licence and DPO checker

    required· ~11 min

    Opens after: POTRAZ Tier & DPO Checker

    Run this on its own
  3. 3

    CDPA Penalty Calculator

    required· ~6 min

    Run this on its own
  4. 4

    Data Protection Needs Assessment

    required· ~22 min

    Run this on its own
  5. 5

    Privacy maturity scorecard

    required· ~9 min

    Opens after: Data Protection Needs Assessment

    Run this on its own
  6. 6

    What data do you hold? (RoPA starter)

    required· ~5 min

    Opens after: Data Protection Needs Assessment

    Run this on its own
  7. 7

    Children and sensitive data screener

    required· ~12 min

    Run this on its own
  8. 8

    Lawful basis finder

    required· ~12 min

    Opens after: What data do you hold? (RoPA starter)

    Run this on its own
  9. 9

    Consent and cookie check

    required· ~11 min

    Opens after: Lawful basis finder

    Run this on its own
  10. 10

    Privacy Notice Grader

    required· ~19 min

    Opens after: What data do you hold? (RoPA starter)

    Run this on its own
  11. 11

    Right-to-be-informed check

    required· ~13 min

    Opens after: Privacy Notice Grader

    Run this on its own
  12. 12

    Could you handle a data request?

    required· ~10 min

    Opens after: What data do you hold? (RoPA starter)

    Run this on its own
  13. 13

    Breach readiness and reporting triage

    required· ~10 min

    Run this on its own
  14. 14

    Information security readiness

    required· ~7 min

    Run this on its own
  15. 15

    Do I need a DPIA?

    required· ~11 min

    Opens after: What data do you hold? (RoPA starter)

    Run this on its own
  16. 16

    Vendor and DPA checker

    required· ~6 min

    Opens after: What data do you hold? (RoPA starter)

    Run this on its own
  17. 17

    Cross-border transfer risk

    required· ~7 min

    Opens after: Vendor and DPA checker

    Run this on its own
  18. 18

    App Builder — Privacy & Security Checklist

    required· ~22 min

    Opens after: Data Protection Needs Assessment

    Run this on its own
  19. 19

    AI and data protection risk

    required· ~10 min

    Opens after: Do I need a DPIA?

    Run this on its own

Save your progress

Every step is free to run right now. Start the pathway to keep the journey in one place — anything you’ve already completed is carried forward, so nothing is asked twice. No account needed: an org code works.