Privacy Maturity Model

Description

This document provides a framework for developing, implementing, maintaining, and evaluating privacy programs within organizations. Privacy programs must be comprehensive enough to address all requirements established by authoritative sources (e.g., laws, regulations, guidance), and must be supported by written policies, appropriate training, ongoing practices, and appropriate assessment. This document may be used to assess both the completeness(whether an organization has identified and implemented all elements of a privacy program), and maturity level(an evaluation of to what degreepractices supporting each element are effective in achieving their intended purpose)of a privacy program. The framework was developed based not only on comprehensive research of relevant laws and guidance, but on practices that have been assessed as effective in many organizations. Introduction.............................................................................................................................3 How to Use This Document....................................................................................................3 Elements of a Privacy Program...............................................................................................3 3.1 Sub-Elements of a Privacy Program................................................................................4 Steps for Completing and Documenting a Privacy Program Analysis...................................6 References...............................................................................................................................7 Appendix A: Privacy Program Analysis Matrix.............................................................................8 5.1.1 Element 1.0: Leadership & Organization..................................................................8 5.1.2 Element 2.0: Privacy Risk Management..................................................................15 5.1.3 Element 3.0: Engineering & Information Security..................................................29 5.1.4 Element 4.0: Incident Response...............................................................................32 5.1.5 Element 5.0: Individual Participation, Transparency, & Redress............................35 5.1.6 Element 6.0: Privacy Training & Awareness..........................................................41 5.1.7 Element 7.0: Accountability....................................................................................44 Appendix B: Summary of Privacy Program Analysis Results.....................................................47