P6.7 Provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy
Provides data subjects with an accounting of the personal information held and disclosure of the data subjects' personal information, upon the data subjects' request, to meet the entity's objectives related to privacy.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Data governance / DLP tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- The underlying record of disclosures that the accounting is produced from, maintained as disclosures occur · Data governance / DLP tooling
- Identity verification evidence performed before the accounting was released · Data governance / DLP tooling
- Evidence the accounting covers all systems holding the individual's personal information, not only the primary one · Data governance / DLP tooling
governing documentDocuments that govern the control
- The process for receiving and responding to data subject requests for an accounting of personal information held and of disclosures made · Policy repository / GRC workspace
- Sample accountings provided to data subjects during the period, with the request and response dates · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Accounting assembled by manual search at request time, so completeness depends on who searches and what they remember
- Disclosures to service providers and internal transfers omitted, leaving the accounting materially incomplete
- No identity verification before release, so the response itself becomes an unauthorised disclosure
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP6.6 Provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity's objectives related to privacy · P7.1 Personal information collected is limited to what is necessary and relevant