Data Privacy Posture Assessments - Key Areas

Key ares to focus on during Data privacy Posture assessments

Area 1: Transparency

·         When user information is collected from individuals, are they made aware of the uses for that information?

·         Are Individuals made aware of any disclosures of their Personal Information to third parties?

·         Have we obtained people's consent for any secondary uses of their personal data, which might not be obvious to them

·         Are our Personal Information-collection practices open, transparent and up-front?

Area 2: Purpose specification

·         Are we clear about the purpose (or purposes) for which we keep personal information?

·         Are the individuals collecting/handling this information also clear about this purpose?

·         Has responsibility been assigned for maintaining a list of all Information sets and the purpose associated with each?

·         Have we checked to make sure that all the information we collect is relevant, and not excessive, for our specified purpose?

Area 3: Use and disclosure of information

·         Are there defined rules about the use and disclosure of information?

·         Are all staffs aware of these rules?

·         Are regulatory and country specific Data Privacy rules taken into consideration before the use and disclosure?

·         Are the individuals aware of the uses and disclosures of their personal data?

·         Whether the consent from the individuals regarding uses and disclosures of their personal information obtained?

Area 4 Personal Information Security

·     Is there a list of security controls in place for each Information set?

·         Is someone responsible for the development and review of these controls?

·         Are these controls appropriate to the sensitivity of the personal data?

·         Are our computers and our databases password-protected, and encrypted if appropriate?

Area 5: Accurateness and Update of Personal Information Stored

·         Do we check our data for accuracy?

·         Do we know how much of our personal data is time-sensitive?

·         Do we take steps to ensure our Personal Information are kept up-to-date?

·         Do Individuals have access/Provisions to update their personal data stored?

Area 6: Retention time

·        Is there a clear statement on information retention period?

·         Are regulatory and country specific Data Privacy rules taken into consideration before deciding the retention period?

·         Do we regularly purge our databases of data which we no longer need, such as data relating to former customers or staff members?

·         Do we have a policy on deleting personal data as soon as the purpose for which we obtained the data has been completed?

Area 7: The Individual Right of Access

·         Do Individuals have access/Provisions to update their personal data stored?

·         Are there clear procedures in place for dealing with such requests?

·         Do these procedures guarantee compliance with the Act's requirements?

Area 8: Data Privacy Awareness Training

·         Do we have Data Privacy awareness training sessions for employees?

·         Do we know about the levels of awareness of data protection in our organisation?

·         Is data protection included as part of the training / Induction program?

Area 9: Regulatory Compliance Visibility

·         Do we have clear visibility over regulatory requirements and country specific Data Privacy rules?

·         Do we have a privacy framework defined for the organisation considering the requirements above?

·         Do we have periodic assessments to gauge the Data privacy Compliance Posture and continuous improvement in place

 Courtesy : ISO 29100 Standard , DSCI Data Privacy Framework ,GDPR and Data protection - Ireland

Auditing a Data Centre – Key points

Data centres house the data, applications and access critical to the success of many businesses. Our data centre must be secure and resilient in order to keep our enterprise running at maximum productivity, protecting our profitability, productivity and reputation.

The audit or health checks (in terms of Information security) revolves around:

 

Now while auditing or preparing the data centres for audit, the key points are:

·         Access Controls (including the emergency exit) - particularly look for audit trails of emergency exit along with fully compliant visitor’s log

·         HVAC controls with properly indicated baselines for Temperature and Humidity controls

·         Fluorescent floor layouts with proper direction to emergency exit doors

·         General check on the data centre design and flooring

·         Fire extinguishers and their suitability to handle fire - last refilling dates

·         Dust free environment - proper mats at the entry-exit

·         Server racks wheel should be locked, also properly stationed if STPI bonded

·         Data and power cable should not criss-cross - to avoid Electromagnetic Inference

·         Power connections are intact including the UPS support

·         Anti-rodents are placed

·         Smoke / fire detector are properly installed and fully functional

·         Intrusion detectors are placed and functional

·         Real time monitoring of entry/exits gate – Including CCTV recordings/footage availability of past