5.34 Privacy and protection of PII
Requires the requirements for preserving privacy and protecting personally identifiable information to be identified and met, in line with applicable laws, regulations and contractual requirements.
5
artefacts
0
held by a system
4
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The record of processing activities, showing what personal data is held, why, on what basis and for how long · Data governance / DLP tooling
- Evidence of the protections applied, such as access restriction, minimisation, pseudonymisation and transfer safeguards · Data governance / DLP tooling
- Evidence of how data subject rights are handled and within what timeframe · Data governance / DLP tooling
- Records of privacy impact assessment where processing carries higher risk · Data governance / DLP tooling
governing documentDocuments that govern the control
- Identification of the privacy and personally identifiable information requirements that apply, per jurisdiction and per contract · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Requirements identified for the home jurisdiction while data of individuals in other jurisdictions is processed under no assessment
- Record of processing created for a compliance deadline and never updated as systems and purposes changed
- Personal data in unstructured stores, test environments and backups omitted from every protection measure
- Retention periods for personal data defined in policy but not enforced anywhere in the estate
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.33 Protection of records · 5.35 Independent review of information security