10 Steps to Minimize Risk & Strengthen Your Privacy and Data Protection Program

A Privacy Checklist for Security Teams

Executive Summary

Privacy is a growing part of the day-to-day operations of security teams. This checklist walks you through the key elements for you and your team to consider when building your privacy program.

Steps:

1. Know your Processing Environment
2. Identify Your Privacy Collaborators & Cooperative Model
3. Understand How Privacy Laws Impact Security Management
4. Align Data Retention & Privacy Policies
5. Advise Reasonable Data Subject Identity Verification
6. Contribute to Privacy/Data Protection Impact Assessments
7. Validate Security Promises in Privacy Statements
8. Holistically Manage Third-Party Risk
9. Train the Company
10. Improve, Iterate, Evolve

Strong privacy programs are built with security at the foundation. This checklist walks you through key elements to consider when partnering with privacy practitioners to build customer trust and outsmart business risk.

STEP ONE: Know Your Processing Environment

Successful privacy programs start with a solid grasp of their processing environment. Why? Personal data isn’t just a confidential business asset, it’s a specially regulated class of data.

Your whole company is responsible for handling personal data lawfully, transparently, proportionally, and securely throughout its entire lifecycle, while also protecting it from unauthorized access, alteration, or destruction. In some cases, this means not having the data in the first place.

To apply the right safeguards to the right data, you need to know where the data lives and understand what it’s used for. According to Okta’s report "Businesses at Work 2023", large companies (2,000 or more employees) use an average of 211 different software applications across operations. Can you confidently say you know every application any employee in your organization has ever used?

An effective privacy and data protection program can help cover your blind spots with system and data discovery that relates the information through data mapping. This is a foundational activity that benefits privacy and security practitioners.

Bottom Line: Use this critical information to gain actionable visibility into your processing environment. Zero in on assets and vendor relationships that may be particularly enticing (or vulnerable) to threats. A personal data breach is a nightmare scenario for everyone.

Document loading complete. You are on page 1.