8.5.3 Records of PII disclosure to third parties
The organization must record disclosures of personal data to third parties, including what data was disclosed, to whom and when, recording disclosures made in normal operations and additional disclosures such as those ar
4
artefacts
2
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Disclosure log covering routine and exceptional disclosures · SIEM / log platform
- Access control and retention rules over the log itself · Identity provider / directory
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Source of the disclosure and the authority relied on, per entry · Document repository
- Coverage of investigation and audit disclosures · Policy repository / GRC workspace
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Law enforcement and audit disclosures handled outside the logged route
- Log recording that a disclosure occurred without identifying what data left or whose
- Authority not recorded, so the disclosure cannot later be justified to the customer
- Log held by the responding function rather than centrally, so no complete picture exists
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.5.2 Countries and international organizations to which PII can be transferred · 8.5.4 Notification of PII disclosure requests