Privacy Operation Life Cycle: Chapter 7 Sustain: Monitor and Audit

Question 1

Privacy Metrics

Answer 1

Reflect currency and value to org

Must add value by accurately reflecting the state of the business goals

Question 2

Most popular metrics

Answer 2

Incident response
PIAs / DPIAs
Training and awareness
DSARs

Question 3

Trend analysis

Answer 3

Time component: spot patterns, trend series

Cyclical component: regular fluctuations

Irregular component: remaining noise

Question 4

Program Maturity Model (PMM)

Answer 4

1. Ad Hoc: informal process
2. Repeatable: procedures and process, not fully documented or covered
3. Defined: fully documented, implemented, and cover all relevant aspects
4. Managed: reviews are conducted to assess control effectiveness
5. Optimized: regular review and feedback for continual improvement

Question 5

Categories for Board report

Answer 5

1. Defending the company
   Number of incidents reported
   Number of incidents actual
   Number of reportable incidents
   Attempted intrusions
   Attempted DDOS attacks
   Average investigation and response time
2. Complying with legal responsibilities and regulations
   Complaints by data subjects
   Data access requests
   Rectification requests
   Unsubscribe requests
   Erasure requests
   Stop processing requests
   Data download requests
3. Advising the business
   PIAs (with ave completion time)
   DPIAs (with ave completion time)
   Staff receiving privacy training (percent)

Question 6

Additional categories for reporting

Answer 6

Number of staff
Budget
Number of products or services using PD
Total number of data subjects
Number of processors

Ratio of privacy to org employees
Ratio of privacy to Legal employees
Process with consumer vs employee data

Question 7

GDPR mandated categories for reporting

Answer 7

DPIAs conducted
DSARs received
Complaints received
Data security incidents
How many elevated to notifications of DPAs

Question 8

Monitor: types

Answer 8

Compliance: audits of collection, use, retention
Regulation: changes to law
Environment: internal and external factors
Training Data: by topic and employee

Question 9

Monitor: forms

Answer 9

Tools: active scanning
Audits: internal/external
Breaches: tracking types, severity
Complaints: type and origin
Data retention: records management, retention risk
Controls: assessing the design and efficacy
HR: investigations related to compliance
Suppliers/Third parties

Question 10

Audits

Answer 10

Evaluating the effectiveness of controls

Question 11

Audit phases

Answer 11

Plan
Prepare
Audit
Reporting
Followup

Question 12

Types of Privacy Program Metrics

Answer 12

Risk reduction metrics
Business enablement metrics
Data Enhancement metrics