P6.1
Points of Focus
Communicates Privacy Policies to Third Parties [P][C]
Privacy policies or other specific instructions or requirements for handling personal information are communicated to third parties to whom personal information is disclosed.
Discloses Personal Information Only When Appropriate [P][C]
Personal information is disclosed to third parties only for the purposes for which it was collected or created and only when implicit or explicit consent has been obtained from the data subject, unless a law or regulation specifically requires otherwise.
Discloses Personal Information Only to Appropriate Third Parties [P][C]
Personal information is disclosed only to third parties who have agreements with the entity to protect personal information in a manner consistent with the relevant aspects of the entity's privacy notice or other specific instructions or requirements.
Discloses Information to Third Parties for New Purposes and Uses [P][C]
Personal information is disclosed to third parties for new purposes or uses only with the prior implicit or explicit consent of data subjects.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Privacy | Data Sharing Agreement | Documented evidence of formal data sharing practices that address, at a minimum: • The business justification for the data sharing; • The type / category of data being shared; • The third-parties the data is being shared with; • Lawful bases for data sharing; and • Data subject rights. |
| Third-Party Management | Third-Party Contracts | Documented evidence of third-party contractual obligations for cybersecurity & data privacy protections. |