Have data subjects or their representatives been consulted? (If not, why not?) - Has the Data Protection Officer been consulted? - Has the ethics committee reviewed this assessment? - Have technical security experts reviewed the safeguards?