PM-19 Privacy Program Leadership Role. Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy
Privacy Program Leadership Role. Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage p.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Appointment record for the senior agency official for privacy, and their position description · Data governance / DLP tooling
- Evidence the official coordinates and implements privacy requirements, such as signed privacy impact assessments and notices · Data governance / DLP tooling
- Records of privacy risk decisions made or escalated by the official · Data governance / DLP tooling
governing documentDocuments that govern the control
- Documentation of the authority, mission, accountability and resources assigned to the role · Policy repository / GRC workspace
- Reporting line showing the official's access to senior leadership · Document repository
First move
Common gaps auditors find
- Role assigned as an additional duty with no resources, so authority exists on paper only
- Official appointed but not involved in the privacy impact assessments and notices the role should own
- No reporting line to leadership, so privacy risk stops below the decision makers
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-18 Privacy Program Plan. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program, and: Includes a description of the structure of the privacy program and the resources · PM-20 Dissemination of Privacy Program Information. Maintain a central resource webpage on the organization's principal public website that serves as a central source of information about the organization's privacy program and that: Ensures that the