Page 1 of 4

KEPLER Privacy Readiness Checklist

For Tech Startups and Scaleups

This checklist helps tech companies quickly assess their privacy posture before audits, RFPs, or investor due diligence. If you answer “No” or “Not sure” to 3 or more questions, it may be time to bring in expert support.

1. Core Privacy Practices

We can map where our users’ data is stored and processed, including vendors

We can map where our users’ data is stored and processed, including vendors
A
B
C

Our team understands the difference between data controller and data processor

Our team understands the difference between data controller and data processor
A
B
C

We have a public-facing Privacy Policy (Notice) tailored to our actual data practices

We have a public-facing Privacy Policy (Notice) tailored to our actual data practices
A
B
C

We maintain an internal Record of Processing Activities (RoPA) or equivalent documentation

We maintain an internal Record of Processing Activities (RoPA) or equivalent documentation
A
B
C

We know our legal bases for processing personal data (e.g., consent, contract, legitimate interest)

We know our legal bases for processing personal data (e.g., consent, contract, legitimate interest)
A
B
C

2. Risk & Compliance Safeguards

We perform vendor due diligence before signing contracts with processors

We perform vendor due diligence before signing contracts with processors
A
B
C

We have signed or requested Data Processing Agreements (DPAs) where needed

We have signed or requested Data Processing Agreements (DPAs) where needed
A
B
C

We have documented procedures for handling data subject requests (DSRs)

We have documented procedures for handling data subject requests (DSRs)
A
B
C

We’ve assessed whether a DPIA is required for our processing activities

We’ve assessed whether a DPIA is required for our processing activities
A
B
C

Our team knows what to do in case of a personal data breach

Our team knows what to do in case of a personal data breach
A
B
C

3. Bonus Readiness Signals

We’re aware of privacy laws requirements based on our markets

We’re aware of privacy laws requirements based on our markets
A
B
C

We’ve prepared answers to privacy questions in client, vendor, or investor reviews (due diligence)

We’ve prepared answers to privacy questions in client, vendor, or investor reviews (due diligence)
A
B
C

We are confident we can pass an enterprise-level privacy assessment or audit

We are confident we can pass an enterprise-level privacy assessment or audit
A
B
C

We’ve considered appointing an external DPO or privacy consultant

We’ve considered appointing an external DPO or privacy consultant
A
B
C
Untitled checkboxes field
KEPLER Privacy Notice