1. Cloud Services Security: Required when the organization uses cloud services for client data storage or processing

2. International Data Transfers: Necessary when client data is transferred across borders

3. Industry-Specific Requirements: Added for organizations in regulated industries like financial services or healthcare

4. Mobile Device Management: Required when staff access client data through mobile devices

5. Third-Party Risk Management: Needed when third-party vendors have access to client data

6. Data Protection Impact Assessments: Required for organizations handling high-risk or sensitive client data

7. Special Categories of Data: Necessary when handling sensitive personal data like biometric or health information

1. Schedule A - Data Classification Matrix: Detailed matrix defining data classification levels and handling requirements

2. Schedule B - Security Controls Checklist: Comprehensive list of required security controls and their implementation status

3. Schedule C - Incident Response Procedures: Detailed procedures for different types of security incidents

4. Schedule D - Approved Technology List: List of approved technologies and tools for handling client data

5. Appendix 1 - Security Awareness Training Materials: Training materials and requirements for staff

6. Appendix 2 - Compliance Monitoring Checklist: Detailed checklist for regular compliance monitoring

7. Appendix 3 - Data Processing Agreement Template: Template agreement for third-party data processors