“We recommend evaluating business systems and your approach to data security and how data is managed across your organisation.  We consider data access and IT policy with regards to data storage devices fixed and external.  We also give consideration to data backups and data retention within your organisation, and any external 3rd party services that store data from your organisation.  In detailing all these vital topics, we relate to the individual Articles and Recitals of the GDPR Regulation.”