Please enable JavaScript.

Coggle requires JavaScript to display documents.

2.5 Privacy principles (IS auditor may also be called on to give assurance…

- - - - It should be systematically built into policies, standards and procedures from the beginning.
    - - Only the data required for the purpose should be collected in the first instance.
- - - - • Pinpoint the nature of personally identifiable information associated with business processes.
      - • Document the collection, use, disclosure and destruction of personally identifiable information.
      - • Ensure that accountability for privacy issues exists.
      - • Identify legislative, regulatory and contractual requirements for privacy.
      - • Be the foundation for informed policy, operations and system design decisions based on an understanding of privacy risk and the options available for mitigating that risk.
- - - - so that privacy compliance is built into projects rather than retrofitted.
        
        focus and extent of privacy impact analysis or assessment may vary depending on changes in technology, processes or people
        
        Technology
        
        • New programs
        
        • Changes in existing programs
        
        • Additional system linkages
        
        • Data warehouse
        
        • New products
        
        Processes
        
        • Change management
        
        • Business process reengineering
        
        • Enhanced accessibility rules
        
        • New systems
        
        • New operations
        
        • Vendors
        
        People
        
        • Business partners
        
        • Service providers
- - - - Choice and consent
        
        appropriate consent has been obtained prior to the transfer of personal information to other jurisdictions?
      - Legitimate purpose specification and use limitation
      - Personal information and sensitive information life cycle
        
        Retention
      - Accuracy and quality
        
        enterprise implement practices and processes to ensure that personal information is accurate, complete and up to date?
      - Openness, transparency and notice
        
        enterprise provide clear and easily accessible information about its privacy policies and practices
      - Accountability
        
        enterprise assign roles, responsibility,
        accountability and authority for performing privacy processes?
      - Individual participation
        
        enterprise provide data subjects a
        process to access their personal information?
      - Security safeguards
        
        enterprise ensure that appropriate security
        safeguards are in place for all personal information
      - Monitoring, measuring and reporting
        
        enterprise report compliance with policies, standards and laws
      - Preventing harm
        
        enterprise establish processes to mitigate any
        personal harms that may occur to data subjects
      - Third-party/vendor management
        
        enterprise implement governance processes to ensure the appropriate protections and use of personal information that are transferred to third parties
      - Breach management
        
        established a documented policy and supporting procedure for identifying, escalating and reporting incidents
      - Security and privacy by design
        
        enterprise ensure executive support for the identification of personal information and privacy risk within enterprise events
      - Free flow of information and legitimate restriction
        
        enterprise follow the requirements of applicable data protection authorities for the transfer of personal information across country borders