P6.2 Records of personal information disclosures are maintained
Creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity's objectives related to privacy. The following point of focus, which applies only to an eng.
5
artefacts
2
held by a system
2
at each review
moderate
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Evidence the register is complete, covering automated and system to system disclosures as well as manual ones · Data governance / DLP tooling
- Reconciliation of the register against other sources, such as integration configuration and vendor inventories · Vendor register / contract repository
periodic reviewEvidence produced at each review
- Evidence entries are created at the time of disclosure rather than reconstructed later · Data governance / DLP tooling
- Evidence of retention of the records for the required period · Data governance / DLP tooling
governing documentDocuments that govern the control
- The register of authorised disclosures of personal information, showing recipient, information disclosed, purpose and date · Policy repository / GRC workspace
First move
Start with the 2 of 5 artefacts that already live in a system (Data governance / DLP tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Register captures manual disclosures while continuous automated flows to third parties are never recorded
- Entries reconstructed at audit time, which fails the timeliness the criterion requires
- No reconciliation, so a disclosure route introduced by an engineering change never enters the register
- Register held by one team with no view of disclosures made by other parts of the business
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP6.1 Personal information is disclosed to third parties only as committed · P6.3 Creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity's objectives related to privacy. The following point of focus, which