P6.7
P6.7
The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy.
Category
Privacy
Subcategory
Privacy Criteria Related to Disclosure and Notification
Points of Focus
Responds to Data Controller Requests [P]
The entity has a process to respond to data controller requests for an accounting of personal information held in accordance with service agreements and privacy objectives.
Identifies Types of Personal Information and Handling Process[P][C]
The types of personal information and sensitive personal information and the related processes, systems, and third parties involved in the handling of such information are identified.
Captures, Identifies, and Communicates Requests for Information[P][C]
Requests for an accounting of personal information held and disclosures of the data subjects' personal information are captured, and information related to the requests is identified and communicated to data subjects to support the achievement of the entity's objectives related to privacy.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Incident Response | Incident Response Program (IRP) | Documented evidence of a Incident Response Plan (IRP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Incident Response | Incident Reporting Capability | Documented evidence of a capability to provide situational awareness of incidents to internal stakeholders and generated necessary reporting to affected clients, applicable third-parties and regulatory authorities. |