P1.1 Privacy notice provides clear notice about privacy practices
Provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Version history of the notice with the dates of change, and evidence changes were communicated to data subjects in a timely manner · Data governance / DLP tooling
periodic reviewEvidence produced at each review
- Evidence the notice is written in plain and conspicuous language, and evidence of the review that concluded so · Data governance / DLP tooling
governing documentDocuments that govern the control
- The privacy notice as published, covering the purposes for collection, use, retention and disclosure of personal information · Policy repository / GRC workspace
- Evidence the notice is provided at or before the point of collection, and evidence of the mechanism used · Policy repository / GRC workspace
- Reconciliation between the practices described in the notice and the processing actually performed · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Data governance / DLP tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Notice describes practices the entity no longer follows, or omits processing it has since started, so the notice and the reality diverge
- Changes to the notice published silently with no communication to existing data subjects
- Notice provided after collection, or buried where it is not conspicuous at the point of collection
- No evidence of the review confirming the notice matches actual processing, which is the substantive test
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCC9.2 Risk mitigation activities include assessment of vendor and business partner controls · P2.1 Consent is obtained for the collection, use, and disclosure of personal information