8.5.4 Notification of PII disclosure requests
The organization must notify the customer of any legally binding request for disclosure of personal data, notifying within agreed timeframes and according to an agreed procedure which can be set out in the customer contr
4
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Records of requests received, notifications made, and where notification was prohibited, the basis · Document repository
- Legal review step before any disclosure is made · Document repository
governing documentDocuments that govern the control
- Documented procedure for handling legally binding disclosure requests, including the notification route and timeframe · Policy repository / GRC workspace
- Contract terms setting the agreed timeframe and procedure · Vendor register / contract repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Requests handled by whoever receives them, with no procedure and no notification
- Notification prohibition assumed from the tone of the request rather than established legally
- No record kept where notification was prohibited, so the organization cannot show it acted properly once the prohibition lifts
- Timeframe agreed in contract but not achievable by the actual process
- Notification sent to a commercial contact rather than the customer's privacy function
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.5.3 Records of PII disclosure to third parties · 8.5.5 Legally binding PII disclosures