7.3.3 Providing information to PII principals
The organization must give individuals clear and easily accessible information identifying the controller and describing the processing of their data, delivered in a timely, concise, complete, transparent, intelligible a
4
artefacts
0
held by a system
3
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of delivery at the point of collection · Document repository
- Evidence of permanent accessibility after collection · Document repository
- Readability or comprehension assessment appropriate to the audience, especially where children are involved · Document repository
governing documentDocuments that govern the control
- The notice as actually presented, in each channel and language used · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Notice legally complete and written at a reading level the audience cannot use, which fails the intelligibility requirement
- Notice linked at collection and then buried, so it is not permanently accessible in practice
- Notice available in the organization's language only while collection happens in others
- Layered notice whose top layer omits something material rather than summarising it
- Notice provided after collection where before was practicable
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.3.2 Determining information for PII principals · 7.3.4 Providing mechanism to modify or withdraw consent