Data Protection Act, 2019
Privacy notice
How the information in this questionnaire is collected, used and kept.
Who is responsible
The Internal Audit Review team is the data controller for this review.
The questionnaire supports a county-by-county assessment of Internal Audit Functions and
Audit Committees for FY2023/24, FY2024/25, FY2025/26.
What is collected
- About you: your name, designation, department, official email address and telephone
number, as you enter them in Section A, and your signature on the Declaration.
- About your County: the answers to the questionnaire, the figures in the three-year
tables, and any documents you upload.
- About your use of the system: the times you sign in, the pages you open, and the
internet address you connect from. This is kept so that access to county information can
be accounted for.
Sensitive answers
Two parts are treated with particular care:
- Question B7 asks whether anyone has been pressed to alter, delay or suppress audit
findings. The questionnaire asks you to explain without naming individuals, and you
should not name them.
- Section K is the County Treasury's assessment of Internal Audit.
Neither is shown to other county users. Both are visible only to the review team.
Why it is collected, and on what basis
To carry out a statutory oversight function under the Public Finance Management Act and its
Regulations. Processing is necessary for the performance of a task carried out in the public
interest and in the exercise of official authority, under section 30 of the Data Protection
Act, 2019.
Who sees it
- The review team.
- Your own County: each account sees only its own county's answers, never another's.
- Findings may be published in aggregate — comparisons across counties, averages and
rankings. Individual officers are not identified in published findings.
How it is protected
- Answers, signatures and uploaded documents are encrypted at rest.
- Passwords are stored only as one-way hashes and cannot be read back, even by an administrator.
- The connection is encrypted in transit.
- Sign-in is limited to five attempts, and every access to a county's information is logged.
- Uploaded files are held outside the public web folder and served only after an access check.
How long it is kept
For the duration of the review and the retention period that applies to public financial
records. It is not used for any purpose outside this review.
Your rights
Under the Data Protection Act, 2019 you may ask to see the personal information held about you,
ask for it to be corrected if it is wrong, and object to how it is processed. You may also
complain to the Office of the Data Protection Commissioner.
To exercise any of these, contact the review team.