EvidenceSheet

PT-3 Personally Identifiable Information Processing Purposes. Identify and document the [organization-defined] for processing personally identifiable information; Describe the purpose(s) in the public privacy notices and policies of the organization; Restrict the [organization-defined] of personally identifiable

Personally Identifiable Information Processing Purposes. Identify and document the [organization-defined] for processing personally identifiable information; Describe the purpose(s) in the public privacy notices and poli.

5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

  • Monitoring records showing changes in processing were reviewed against the stated purposes · SIEM / log platform

periodic reviewEvidence produced at each review

  • Evidence processing is restricted to the identified purposes, such as access controls or data use rules · Data governance / DLP tooling

governing documentDocuments that govern the control

  • The identified and documented purposes for processing personally identifiable information · Policy repository / GRC workspace
  • The public privacy notices and policies where those purposes are described, showing consistency with the internal record · Policy repository / GRC workspace
  • Records where the notice was updated because a purpose changed · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

PT-2 Authority to Process Personally Identifiable Information. Determine and document the [organization-defined] that permits the [organization-defined] of personally identifiable information; and Restrict the [organization-defined] of personally identifiable information to only that which is authorized · PT-4 Consent. Implement [organization-defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making