P6.1 Personal information is disclosed to third parties only as committed
Discloses personal information to third parties with the explicit consent of data subjects, and such consent is obtained prior to disclosure to meet the entity's objectives related to privacy.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence of the consent obtained before disclosure, with its date preceding the disclosure · Data governance / DLP tooling
- Evidence of the mechanism preventing disclosure where consent was not given or was withdrawn · Data governance / DLP tooling
- Records of disclosures made in the period, reconciled to the consent held · Data governance / DLP tooling
governing documentDocuments that govern the control
- The inventory of third parties to whom personal information is disclosed, and the purpose of each disclosure · Vendor register / contract repository
- Contractual terms with each recipient governing their use of the information · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Consent obtained generally at signup and treated as covering disclosures introduced afterwards
- Disclosures through integrations, tags and analytics services never recognised as disclosures at all
- No mechanism enforcing consent, so a withdrawal does not stop the data flow
- Reconciliation between actual disclosures and consent never performed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP5.2 Corrections to personal information are processed timely · P6.2 Records of personal information disclosures are maintained