Personal and other data is governed. Foundational: there are policies and procedures, backed by compulsory training, covering data protection duties such as answering data subject access requests (DSARs); and any breach, loss or leak of data, personal or otherwise, that could affect the Lloyd's market is notified to Lloyd's within the timescales set by law. Intermediate: a data protection framework exists with appropriate senior ownership, aligned to the cyber security strategy, which makes information retention and disposal clear and helps keep an information asset register current; a procedure ensures data is classified electronically by sensitivity. Established: data governance is resourced so that retention and disposal policies are reviewed regularly for effectiveness, and processes allow complex DSARs to be answered within the required timeframes. Advanced: data protection obligations, retention policies and requirements on classification and ownership are firmly built in throughout the organisation. The earlier guidance also expected any loss of personal data to be notified to Lloyd's no later than 72 hours after it was detected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.