Privacy Governance Flashcards
Where Privacy Office usual sit within a company
Legal (46%) • Regulatory compliance (27%) • Information security (15%) • Corporate ethics (8%) • Information technology (5%) • Other (24%)
Privacy Strategy in creating a program
Business Alignment
Data Governance of Personal Information
Inquiry/Complaint handling procedures
Privacy Governance Models
3
Centralized
Decentralized
Hybrid
Develop and implement the privacy
program/policy framework
Develop the program framework
•Develop organizational privacy
policies and standards/guidelines
•Define privacy program activities
Implement the policy framework
•Communicate the framework to internal and external stakeholders •Ensure continuous alignment to applicable laws/regulations to support the development of an organizational privacy program framework
Privacy Framework
Principles and standards
- FIPs
- OECD Guidelines
- GAPP
- CSA Privacy Code
- APEC Framework
- BCRs
Privacy Framework
Laws, regulations and programs
- PIPEDA
- APPs
- EU legislation
- EU-U.S. Privacy Shield
- HIPAA
- Jurisdictional and sectoral laws and guidance
Privacy Framework
Privacy program
management
solutions
• PbD • COBIT 2019 • NIST privacy engineering/risk management • WebTrust • Vendor solutions
GRC
Management Tool
Goverance, Risk management and Compliance
Can use a Tool but need to have the backbone in place first.
was invented as a shorthand reference to the critical capabilities that must work together to achieve Principled Performance-- the capabilities that integrate the governance, management and assurance of performance, risk, and compliance activities.”
Enterprise Program Management
EPM
A type of privacy tech vendor
- Data discovery
- Activity monitoring
- De identification/pseudonymization
- Enterprise communications
- Data Mapping
Privacy Program Management
PPM
A type of privacy tech vendor
- Privacy assessment management
- Consent management
- Incident response
- Website scanning/cookie compliance
- Data Mapping
Information Security Department Focuses on…
CIA
Confidentiality
Integrity
Availability
RACI
Responsible
Accountable
Consulted
Informed
Internal Audit and Risk Management Functions
Internal Audit and Risk Management Functions: Threats, Controls (how effective are they?), Functions and Operations.
How to work better with them. Engage them on their terms: Have audit look at privacy pain points (issues), use same methodology as risk management so aligned, best to look prior to breach.
