8.3.1 Obligations to PII principals
The organization must provide the customer with the means to comply with its obligations to individuals, recognising that those obligations may be set by legislation, regulation or contract and may include matters where
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Documented capabilities for access, correction, deletion, export and restriction, offered to customers · Document repository
periodic reviewEvidence produced at each review
- Evidence the capabilities work at the volumes the customer's obligations imply · Document repository
governing documentDocuments that govern the control
- Contract terms specifying the information and technical measures the customer may rely on · Vendor register / contract repository
- Service level or response time for assistance, and performance against it · Document repository
First move
Start with the 1 of 4 artefacts that already live in a system (Document repository); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Deletion offered only as a bulk end of contract operation, which cannot serve an individual erasure request
- Assistance provided by manual engineering effort with no service level, so the customer's own deadline is at risk
- Capabilities existing in the product but not specified in the contract, so the customer cannot rely on them
- Correction possible in the primary store while derived and cached copies stay stale
- Assistance excluding data held by the organization's own subcontractors
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.2.6 Records related to processing PII · 8.4.1 Temporary files