Privacy Operations
When it comes to privacy management within your organization, a multi-faceted approach will help you cover every area of the business and stay compliant.
Establish Governance
Every member of the privacy team should have specific areas of responsibility and defined accountability standards. If there’s no one within the company whose primary focus is privacy, an option is to appoint someone to be responsible for privacy. While they don’t need to run all the implementation, they can identify what help is needed to do the work—whether internally, externally or both.
Policies & Standards
Privacy policies and standards should be reviewed regularly to make sure they’re easy to understand, match actual company processes, and meet regulatory compliance requirements.
Data Inventory
Data inventories, also known as data mapping, are the best way to understand what types of data are being collected and why, who has access to this data, where it’s shared or sold, and where it’s vulnerable to exposure.
Privacy Impact Assessments
Privacy impact assessments evaluate exposure risks to personal information when implementing new or modifying existing processes, programs, or products.
Individual Rights
Consumers have specific rights in how their personal information is collected and used (for example some common ones are right to know, right to deletion, right to opt out, right to non-discrimination), mandated by most data privacy laws. To comply with these laws, companies must have processes that allow individuals to easily and quickly execute these rights.
Vendor Management
Businesses can be held liable if data they shared with a third-party vendor is exposed when the vendor is hacked. A vendor risk-management program ensures data controllers and processors adhere to the same privacy standards, and this includes how data is being used. For example, it’s critical to know vendors aren’t selling data or using it for purposes beyond being a service provider.
Marketing Strategy & Preference Marketing
A strong data privacy program allows individuals to choose how they receive information, what type of information they want to get (for example, new releases only or every email the company sends to its list), and how often they receive marketing communications, as well as whether their data is shared with other organizations.
Security
Combined with privacy-friendly processes, industry standard reasonable security measures such as multifactor authentication, encryption, password requirements, VPN use, and permission structures provide another layer of protection for valuable data.
Training
Comprehensive training programs build a culture of privacy and help reduce the most common cause of data breaches—human error.
Sustainable Compliance
Compliance is a journey, not a destination. To keep up with new regulations and privacy best practices, it’s important to establish regular policy reviews, update the data inventory annually, and create a “privacy by design” culture
