Manage the Privacy Management library
The Privacy Management library consists of authority documents, citations, control objectives, policies, and [PI] Information objects that help to manage the privacy content.
Authority documents
Authority documents are the principles, guidelines, regulations, standards, and frameworks that organizations must comply with. Some examples of authority documents are:
- Statutes (Bills or Acts)
- Regulations
- Audit Guidelines
Organizations can either create the authority documents, citations, and control objectives or they can download and import them from a third-party provider such as the Network Frontiers Unified Compliance Framework (UCF). You can create and manage authority documents from Library > Authority documents in the List view of the Privacy Workspace.
Citations
Citations are records with the specific requirements cited by an authority document. A citation relates authority documents to its applicable controls. Each citation has control objectives. You can add citations to the Library from the List view of the Privacy Workspace.
Policies
Policies include control objectives. Policies can also be associated to authority documents. Policies are published and regularly updated with incremented versions. You can add policies to the Library from the List view of the Privacy Workspace.
Risk statements
Using risk statements you can create a central risk register to manage potential privacy risks that may occur any time and any where in an organization. You can add risk statements to the Library from the List view of the Privacy Workspace.
Privacy assessments
Privacy assessments are used to collect information from business owners. This information helps the privacy teams to understand how personal information (PI) is being used or stored in a processing activity.
Risk assessments
The risk assessments capability enables you to determine the organizational privacy risk posture using criticality and privacy risk assessments.
PI Information objects
[PI] Information objects refer to information objects that are of type Personal information. To understand the benefit of using information objects in the Privacy Management solution, refer to Information objects in Privacy Management. Maintaining a library of [PI] Information objects and associating them with the processing activities helps the privacy teams to understand what personal information (PI) is being processed by the processing activity.
Only the information objects that are tagged with the Personal information tag are available to be added to a processing activity. For more information on how to tag information objects see, Classify information objects as personal information.
- Create an information object
Create information objects manually to associate the right data subject types with business processes or applications. - Configure information object categories
Configure information object categories to classify information objects effectively. For example, attributes like iris scans and fingerprints are often referred to as biometric data, or email addresses and phone numbers can be grouped as contact information. Information object categories enable you to categorize these information objects under these broader classifications. - Classify information objects as personal information
Categorize information objects as personal information. Only information objects classified as personal information can be associated with the processing activities.
Parent Topic:Configuring Privacy Management
Related topics