https://www.kingqueen.org.uk/ico-on-s42-assessments-of-data-controllers-compliance-with-s10/