P4.1 Personal information is used for purposes identified in privacy commitments
Limits the use of personal information to the purposes identified in the entity's objectives related to privacy. The following point of focus, which applies only to an engagement using the trust services criteria for.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence of controls limiting use to those purposes, such as access restriction by purpose, system configuration or approval for new uses · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Records of requests for new or secondary uses and the assessment and approval of them · Data governance / DLP tooling
- Evidence of review of actual use against the stated purposes, sampled across systems and teams · Data governance / DLP tooling
- Evidence covering use by third parties acting on the entity's behalf · Vendor register / contract repository
governing documentDocuments that govern the control
- The record of purposes for which personal information may be used, tied to the privacy notice and to the consent obtained · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- New uses adopted by product or analytics teams with no assessment against the stated purposes
- Use limitation stated in policy with no technical or procedural control preventing anything
- Personal information copied into analytics and machine learning environments where purpose is no longer tracked
- Third party use unconstrained beyond a general confidentiality clause
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP3.2 Explicit consent is obtained for sensitive personal information · P4.2 Personal information is retained for only as long as needed