P1.1
Points of Focus
Communicates to Data Subjects [C]
Notice is provided to data subjects regarding the following: - Purpose for collecting personal information - Choice and consent - Types of personal information collected - Methods of collection (for example, use of cookies or other tracking techniques) - Use, retention, and disposal - Access - Disclosure to third parties - Security for privacy - Quality, including data subjects' responsibilities for quality -Monitoring and enforcement If personal information is collected from sources other than the individual, such sources are described in the privacy notice.
Provides Notice to Data Subjects [C]
Notice is provided to data subjects- (1) at or before the time personal information is collected or as soon as practical thereafter, (2) at or before the entity changes its privacy notice or as soon as practical thereafter, or (3) before personal information is used for new purposes not previously identified.
Covers Entities and Activities in Notice [C]
An objective description of the entities and activities covered is included in the entity's privacy notice.
Uses Clear Language and Presents a Current Privacy Notice in a Location Easily Found by Data Subjects [C]
The entity's privacy notice is current, dated, uses clear language, and is in a location that can be easily found by data subjects.
Reviews the Privacy Notice [C]
A process is defined to periodically review the content of the privacy notice and to implement any identified updates.
Communicates Changes to Notice [C]
Data subjects are informed when changes are made to the privacy notice and the nature of such changes.
Retains Prior Notices [C]
Prior versions of the privacy notice are retained in accordance with internal requirements to document prior communications.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Privacy | Data Privacy Notice | Documented evidence of a publicly-accessible data privacy notice. |