P2.1 Consent is obtained for the collection, use, and disclosure of personal information
Communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collec.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the mechanism by which a data subject exercises or changes a choice, and records of choices exercised in the period · Data governance / DLP tooling
- Evidence consent records are used to drive actual processing, such as suppression or restriction applied downstream · Data governance / DLP tooling
- Evidence of the treatment of withdrawal of consent, including its propagation to third parties · Vendor register / contract repository
governing documentDocuments that govern the control
- Documentation of the choices communicated to data subjects regarding collection, use, retention, disclosure and disposal, and the consequences of each choice · Policy repository / GRC workspace
- Evidence consent is obtained where required, with the record of consent including its date, scope and the version of the notice in force · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Consent captured at the point of collection and never linked to the systems that process the data, so a withdrawal changes nothing
- Consequences of declining a choice not communicated, which the criterion explicitly requires
- Consent recorded without the version of the notice it was given against, so the scope of what was agreed cannot be established
- Withdrawal handled in the primary system while third parties who received the data are never told
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP1.1 Privacy notice provides clear notice about privacy practices · P3.1 Personal information is collected consistent with privacy commitments