PT-4 Consent. Implement [organization-defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making
Consent. Implement [organization-defined] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals' informed decision-making.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The consent tools and mechanisms implemented, with screenshots of the consent presentation as an individual sees it · Data governance / DLP tooling
- Evidence consent is obtained prior to collection · Data governance / DLP tooling
- Retained records of individual consent, showing what was consented to and when · Data governance / DLP tooling
- Evidence the mechanism supports informed decision making, such as plain language and granular choices · Data governance / DLP tooling
- The withdrawal mechanism and evidence that withdrawal stops the processing · Data governance / DLP tooling
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Consent bundled into a single acceptance covering unrelated processing, so choice is not meaningful
- Consent captured as a flag with no record of the wording the individual actually saw
- Withdrawal accepted at the interface while downstream systems keep processing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPT-3 Personally Identifiable Information Processing Purposes. Identify and document the [organization-defined] for processing personally identifiable information; Describe the purpose(s) in the public privacy notices and policies of the organization; Restrict the [organization-defined] of personally identifiable · PT-5 Privacy Notice. Provide notice to individuals about the processing of personally identifiable information that: Is available to individuals upon first interacting with an organization, and subsequently at [organization-defined]; Is clear and easy-to-understand, expressing information