By its very nature a one or two day inspection of an organisation processing a substantial volume of personal data cannot be deemed to be conclusive. Final report findings and recommendations should always be viewed in this context. As previously stated, the inspection team does not set out to examine each piece of personal data processed by the organisation, proceed through each of the eight data protection principles in minute detail or obtain a complete view of security within an organisation. A positive final report is merely indicative of an organisation’s level of compliance with the data protection.
