P8.1 Inquiries, complaints, and disputes regarding personal information are addressed
Implements a process for receiving, addressing, resolving, and communicating the resolution of inquiries, complaints, and disputes from data subjects and others and periodically monitors compliance to meet the entity's o.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the channel is communicated to data subjects and is accessible · Data governance / DLP tooling
- Evidence of periodic monitoring of compliance with privacy commitments and requirements, and of the corrections made as a result · SIEM / log platform
- Evidence of escalation and of root cause action where complaints indicate a systemic issue · Data governance / DLP tooling
governing documentDocuments that govern the control
- The documented process for receiving, addressing, resolving and communicating the resolution of inquiries, complaints and disputes · Policy repository / GRC workspace
- The complaints register for the period, with the date received, nature, resolution and date communicated · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Complaints handled through general customer support with no privacy specific process, so none are identifiable as privacy matters
- Register showing no complaints at all, which auditors read as a broken intake rather than perfect performance
- Resolution reached with no evidence it was communicated back to the data subject
- Periodic compliance monitoring, which the criterion explicitly requires, never performed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetP7.1 Personal information collected is limited to what is necessary and relevant · PI1.1 Obtains or generates and uses relevant quality information to support processing integrity