Privacy and Compliance

Deliverables:

• Interviews with key business stakeholders and data owners
• Baseline for data privacy program maturity
• Identify key areas for improvements and exposure to privacy risk
• Recommendations for short- and long-term action items based on business needs
• Privacy maturity roadmap
• Data privacy report showing where you land on ID’s Information Governance Maturity Assessment

Deliverables:

• Project plan will include initial activities and follow-up remediation items. Examples include tracking the progress of data inventories, training, delivery, etc.
• Project schedule with tasks, resources, and timelines. Tasks can include deliverables provided by the client.
• Regular progress reports, based on the client’s requirements.

Deliverables:

• Review of existing client documentation. Includes internal documentation and externally facing privacy notices and statements.
• Internal employee privacy policy to guide behavior and support other client policies.
• Processes and procedures for data inventories, Privacy Impact Assessments, Data Protection
• Impact Assessments, Data Subject Access Requests (DSARs), and more.
• Training on privacy documentation and policy lifecycle management.

Deliverables:

• Guidance on prioritizing business processes as part of the scope.
• Training on how data inventories fit into a privacy program.
• Tracker of business processes and stakeholders who will respond to data inventory assessment.
• Review of information security controls.
• Review data retention requirements and design workflows as needed to implement client processes.
• Summary of data inventories with recommendations for improvement.
• Assessment of data inventories for higher-risk areas.
• Reporting as required.

Deliverables:

• Training on how the DSAR process fits into a privacy program. Explains roles of Data Controller and Processor, and situations when action is taken.
• Response tracker for DSARs, including key contacts who respond and take action.
• Maintain DSAR metrics.
• Dashboard illustrating DSAR trends.

Deliverables:

• Working with the client, confirms that appropriate Data Processing Agreements (DPAs) are in place.
• Reports of gaps and areas of improvement.
• Report of key third parties that process privacy data.
• Recommend third-party data privacy reviews, based on priorities.
• Dashboard illustrating progress on third-party management.

Deliverables:

• Training on principles of PbD and practical implementation in an organization.
• Training on how PbD fits into an organization’s culture, and the significance of a proactive approach to data privacy.
• Checklist of PbD key points for processes and projects.
• Process for including PbD in the client’s project management program.

Deliverables

• Report on consent and legal basis for processing private data.
• Review of cookie consent implementation.

Deliverables:

• Report on private data transfers and list of applicable regulations.
• Report on risk based on cross-border transfers.

Deliverables

• Assessment report on privacy posture of in-scope organization, highlighting risk areas.
• Project plans to integrate privacy practices of in-scope organization into client.

Deliverables

You can’t run, and you can’t hide! GDPR and CCPA compliance laws aren’t going anywhere and while it seems like a daunting task to get up to date, it’s much worse to be caught violating privacy laws. These privacy and compliance regulations specify deadlines for responding to a DSAR (data subject access request), and if you don’t know where your data is, the timeline is rarely enough to search all systems that may contain subject data.