§1798.110 Right to Know Categories and Specific Pieces of Personal Information Collected
Consumers have the right to request that a business that collects PI about the consumer disclose: categories of PI collected, categories of sources, business or commercial purpose for collecting/selling/sharing, categori
5
artefacts
1
held by a system
0
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Request log with response times · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Right-to-know request intake (toll-free + web form) · Document repository
- Verification procedure documentation · Policy repository / GRC workspace
- Standard disclosure templates covering all five categories · Policy repository / GRC workspace
- 12-month lookback data extracts · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Disclosures aggregate categories rather than specific pieces
- Sources of PI not tracked
- 45-day deadline missed
- Look-back period not maintained
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet§1798.106 Right to Correct Inaccurate Personal Information · §1798.115 Right to Know Personal Information Sold or Shared and Recipients