Business Management Controls

Data Protection and Privacy (DP&P) System Description

Created by John Kyriazoglou

Overview

This system ‘Data Protection and Privacy Management System (DP&P System)’ consists of a methodology; 5 phases and 36 steps; numerous outcomes and 42 products; and over 99 detail actions.

Objective

The objectives of this system are:

1. To enable and facilitate company leaders, managers and staff, to manage better the enterprise’s personal data;

2. To mitigate the usual data protection and privacy risks of collecting and processing personal data; and

3. Comply effectively with the requirements of privacy regimes, such as: EU’s GDPR, Brazil’s LGPD, etc.

DP&P System: Phases, Products and Outcomes

*Phase 1: Data Protection and Privacy Preparation

Phase 1-DP&P Preparation: Process Steps

Step AP# 1: Conduct Privacy Analysis

Step AP# 2: Collect Privacy Laws

Step AP# 3: Analyze Privacy Impact

Step AP# 4: Perform Initial Data Audits and Assessments

Step AP# 5: Establish Data Governance Organization

Step AP# 6: Establish Data Flows and Personal Data Inventory

Step AP# 7: Establish Data Protection and Privacy Program

Step AP# 8: Craft DP& P Implementation Action Plans

Phase 1-DP&P Preparation: Products and Outcome

Product 1: Data protection and privacy analysis report (step 1);

Product 2: Privacy Laws Manual (step 2 and 3);

Product 3: Personal Data Audit Report (step 4);

Product 4: Data Flows System (step 6);

Product 5: Personal Data Inventory (step 6);

Product 6: Data Protection Policy (step 6);

Product 7: Privacy Training Plan (step 7);

Product 8: Data Protection and Privacy Program (step 7);

Product 9: Data Protection and Privacy Organization Report and Budget (steps 1 to 8); and

Product 10: DP& P Implementation Action Plans (steps 1 to 8)

The outcome of Phase 1 is to prepare your enterprise (board, management and staff) to be more effective in dealing with the data protection and privacy risks and in managing and resolving these better so that the impact to the company’s operations, brand-name and profits are minimized as much as possible.

*Phase 2: Data Protection and Privacy Organization

Phase 2-DP&P Organization: Process Steps

Step OS#1: Maintain Data Privacy Program, Policy and Governance Controls

Step OS#2: Assign and maintain Data Protection and Privacy responsibility

Step OS#3: Maintain Senior Management engagement in Data Protection and Privacy

Step OS#4: Maintain Data Protection and Privacy Commitment

Step OS#5: Maintain regular communication for Data Protection and Privacy issues

Step OS#6: Maintain stakeholder engagement in Data Protection and Privacy matters

Step OS#7: Implement and Operate the Data Protection and Privacy Computerized System.

Phase 2-DP&P Organization: Products and Outcome

Product 1: Updated data protection and privacy strategy (step 1);

Product 2: Updated data protection and privacy program (step 1);

Product 3: Data Governance Controls (step 1);

Product 4: Announcement of the appointment of the Data Protection or Privacy Officer (step 2);

Product 5: Communications related to data protection and privacy (step 3, 4, 5 and 6);

Product 6: Data protection and privacy network (step 4);

Product 7: Data protection and privacy role in job descriptions (step 4);

Product 8: Updated Privacy Awareness, Communication and Training Plan (step 5); and

Product 8: Data protection and privacy computerized system (step 7);

The outcome of Phase 2 is to establish the data protection and privacy organizational structures for better data protection and privacy implementation.

*Phase 3: Data Protection and Privacy Development and Implementation

Phase 3-DP&P Implementation: Process Steps

Step DI#1: Develop and implement Data Protection and Privacy Strategies, Plans and Policies

Step DI#2: Implement Approval Procedure for Processing Personal Data

Step DI#3: Register Databases of Personal Data

Step DI#4: Develop and Implement a Cross-Border Data Transfer System

Step DI#5: Execute DP &P integration activities

Step DI#6: Execute DP &P training plan

Step DI#7: Implement Data Security controls

Phase 3-DP&P Implementation: Products and Outcome

Product 1: Personal Data Classification System (step 1);

Product 2: Procedure for Approving the Processing of Personal Data (step 2);

Product 3: Personal Data Bases Registration document (step 3);

Product 4: Step DI#4: Develop and Implement a Cross-Border Data Transfer System (step 4);

Product 5: Executed DP&P integration activities (step 5);

Product 6: Executed DP &P training activities (step 6); and

Product 7: Implemented Data Security controls (step 7);

The outcome of Phase 3 is to develop and implement a set of data protection and privacy measures to govern personal data more effectively for your enterprise.

*Phase 4: Data Protection and Privacy Governance

Phase 4-DP&P Governance: Process Steps

Step GR#1: Implement Practices for Managing the uses of data

Step GR#2: Maintain Data Privacy Notices

Step GR#3: Execute a Requests, Complaints and Rectification Plan

Step GR#4: Execute a Data Protection Risk Assessment

Step GR#5: Issue Data Protection and Privacy Reports

Step GR#6: Maintain Data Privacy Documentation

Step GR#7: Establish and Maintain a Data Privacy Breach Response Plan

Phase 4-DP&P Governance: Products and Outcome

Product 1: Updated data protection and privacy strategy (step 1);

Product 2: Data protection policy (step 1);

Product 3: Procedure for Maintaining Data Privacy Notices (step 2);

Product 4: Requests, Complaints and Rectification Plan (step 3);

Product 5: Data Protection Risk Assessment Process (step 4);

Product 6: Third-Party Risks Management Plan (step 4);

Product 7: Data Protection and Privacy Report (step 5);

Product 8: Data Privacy Documentation (step 6); and

Product 9: Data Privacy Breach Response Plan (step 7);

The outcome of Phase 4 is to establish the data protection and privacy governance structures for better data protection and privacy management.

*Phase 5: Data Protection and Privacy Evaluation and Improvement

Phase 5-DP&P Improvement: Process Steps

Step RI#1: Perform Internal Audits of Data Protection and Privacy

Step RI#2: Engage an external party to perform Data Protection and Privacy assessments

Step RI#3: Perform privacy assessments and benchmarks

Step RI#4: Execute Data Protection Impact Assessments

Step RI#5: Resolve Data Protection and Privacy (DP&P) Risks

Step RI#6: Report DP&P Risk Analysis and Results

Step RI#7: Monitor Data Privacy Laws and Regulations

Phase 5- DP&P Improvement: Products and Outcome

Product 1: Data protection and privacy internal audit report (step 1);

Product 2: Data protection and privacy eternal audit report (step 2);

Product 3: Ad-hoc privacy assessment report (step 3);

Product 4: Privacy self-assessment report (step 3);

Product 5: Privacy benchmark report (step 3);

Product 6: Data Protection Impact Assessment report (step 4);

Product 7: Data Protection and Privacy Resolved Risks report (step 5);

Product 8: DP&P Risk Analysis and Results report (step 6); and

Product 9: Monitoring Privacy Laws Report (step 7);

The outcome of Phase 5 is to audit the data protection and privacy aspects of your enterprise so that you find the gaps and errors in implemented measures and controls related to data protection and privacy and schedule actions to improve them.