When it comes to creating policies for handling personal data in an organization, who decides? How are those policy decisions made and kept up to date?
\r\n
These are questions of governance – I would call it “information governance.” Most large enterprises have established responsibilities and procedures for information technology governance and specifically for IT security policies, procedures, procurement, management, and training. In many cases, however, these have not been fully mapped to personal data compliance and risk management requirements, which should be defined and monitored by a somewhat different group of people, from departments beyond IT and security. Unless privacy issues are visible in the internal governance process, the organization – and the individuals that deal with it -- may be exposed to some nasty surprises.
\r\n
W. Scott Blackmer, Founding Partner, InfoLawGroup LLP
This resource is only available to our paid members. You can Join Us or Sign in to get access to this resource.