Using Privacy Program Management

The Privacy Program Management use case supports the following processes.

Privacy Program Management Processes

The following diagram shows the major phases, key tasks, and users responsible for each task.

Verifying Your Data Inventory

The Data Governance use case (the prerequisite to this use case) enables you to inventory all of your information assets and processing activities. The Privacy Program Management use case contains an additional tool—the Data Identification Assessment—that helps you to verify that you have identified all of your organization's personal and sensitive user data.

Assessing Processing Activity Risk

After you have inventoried all of your information assets and processing activities, the Privacy Program Management use case enables to you perform a risk assessment on all of your processing activities to determine where you have privacy risk exposure.

Here are the tasks to assess processing activity risk:

1. Perform privacy impact assessment.

2. Review privacy impact assessment.

Assessing High-Risk Processing Activities

Once you have assessed the privacy risk of your organization's processing activities, the Privacy Program Management use case enables you to do further assessment on those processing activities that were determined to be high-risk.

Here are the tasks to assess high-risk processing activities:

1. Identify high-risk processing activities subject to a DPIA.

2. Create data protection projects.

3. Determine whether to perform a DPIA.

4. Perform DPIAs.

5. Review DPIAs.

6. Identify risk treatment plans.

7. Consult with Supervisory Authority.

Communicating with Regulators

The Privacy Program Management use case enables you to document and track communication between your organization and any regulators. There are 2 types of communication types that the use case supports: a privacy risk consultation, for cases where you want to review a potentially high-risk processing activity, and a data breach notification, for when you need to inform regulators and data subjects of a data breach.