Page 1 of 4

KEPLER Privacy Readiness Checklist

For Tech Startups and Scaleups

This checklist helps tech companies quickly assess their privacy posture before audits, RFPs, or investor due diligence. If you answer “No” or “Not sure” to 3 or more questions, it may be time to bring in expert support.

1. Core Privacy Practices

We can map where our users’ data is stored and processed, including vendors

A
B
C

Our team understands the difference between data controller and data processor

A
B
C

We have a public-facing Privacy Policy (Notice) tailored to our actual data practices

A
B
C

We maintain an internal Record of Processing Activities (RoPA) or equivalent documentation

A
B
C

We know our legal bases for processing personal data (e.g., consent, contract, legitimate interest)

A
B
C

2. Risk & Compliance Safeguards

We perform vendor due diligence before signing contracts with processors

A
B
C

We have signed or requested Data Processing Agreements (DPAs) where needed

A
B
C

We have documented procedures for handling data subject requests (DSRs)

A
B
C

We’ve assessed whether a DPIA is required for our processing activities

A
B
C

Our team knows what to do in case of a personal data breach

A
B
C

3. Bonus Readiness Signals

We’re aware of privacy laws requirements based on our markets

A
B
C

We’ve prepared answers to privacy questions in client, vendor, or investor reviews (due diligence)

A
B
C

We are confident we can pass an enterprise-level privacy assessment or audit

A
B
C

We’ve considered appointing an external DPO or privacy consultant

A
B
C
Untitled checkboxes field
KEPLER Privacy Notice