PRIVACY AND DATA PROTECTION OPERATIONAL PACKAGE

Privacy Scope · DPIA · Data Subject Requests · Breach Clocks · Evidence Interface

Table of Contents

1. Purpose and Scope
2. Ownership Boundary
3. Privacy Data Inventory
4. Privacy Impact and DPIA Workflow
5. Data Subject Request Support
6. Breach Notification Clock Support
7. Third-Party Privacy Risk
8. Retention, Deletion, and Minimization
9. Evidence Library
10. Metrics
11. Roles and Responsibilities
12. Regulatory and Framework Alignment Summary
13. Document Control

1. Purpose and Scope

CERG does not replace the enterprise privacy, legal, or records-management programs. Those programs determine legal obligations, notices, consent requirements, data subject rights, and regulator communications. CERG supplies the cyber, data governance, asset, vendor, incident, risk, and evidence machinery those privacy decisions need.

This operational package defines how CERG supports privacy and data protection obligations: privacy data inventory, DPIA support, data subject request support, breach-clock facts, vendor privacy evidence, retention and deletion control support, metrics, and evidence.

Privacy Fails When Nobody Can Find the Data

Legal can interpret the obligation. The business can decide the purpose. But if the organization cannot say where personal data lives, who owns it, which vendors process it, how long it is retained, how it is deleted, and what happened during an incident, privacy becomes guesswork. CERG’s role is to remove the guesswork.

2. Ownership Boundary

This package intentionally uses CERG canonical roles. Where a privacy or legal function exists outside CERG, the package describes the interface without renaming it as a CERG role.

3. Privacy Data Inventory

The privacy data inventory extends the asset inventory and data classification standard. It identifies where personal data exists and how it moves.

Minimum inventory fields:

The inventory is reviewed at least annually and when a new system, vendor, data category, or processing purpose is introduced.

4. Privacy Impact and DPIA Workflow

A privacy impact assessment or Data Protection Impact Assessment (DPIA) is required when a change introduces material privacy risk.

Triggers:

• new processing of personal data;
• new sensitive-data category;
• new AI or automated decisioning use case involving people;
• new vendor processing personal data;
• new cross-border transfer or hosting location;
• material change to retention, deletion, or data sharing;
• high-volume monitoring, profiling, or behavioral analytics;
• incident or finding showing privacy control weakness.

CERG supports DPIA with:

1. asset and system inventory;
2. data classification;
3. data-flow and vendor mapping;
4. security controls in place;
5. logging and monitoring posture;
6. deletion and retention capability;
7. third-party control evidence;
8. residual-risk record;
9. evidence package for approval.

DPIA outcomes that require controls are tracked as change actions, risk-register entries, vendor-risk actions, or document updates.

5. Data Subject Request Support

Data subject requests are owned by the enterprise privacy process. CERG supports the technical execution and evidence.

Support steps:

CERG does not decide whether a request is valid or whether an exemption applies. CERG supplies facts and executes approved technical actions.

6. Breach Notification Clock Support

Privacy breach notification clocks often start before the full technical story is known. CERG’s job is to provide reliable facts quickly.

Within the incident process, CERG supplies:

• affected systems and asset owners;
• data categories and data subject groups;
• regulated geographies and contractual obligations known to CERG;
• approximate data volume if available;
• access logs, DLP events, exfiltration indicators, and containment actions;
• vendor involvement;
• encryption, tokenization, or other protective control status;
• evidence of when the event was detected, escalated, contained, and resolved.

Notification decisions remain with the Incident Commander, legal, executive, and enterprise privacy process. CERG preserves the evidence and records residual control gaps.

The Clock Does Not Wait for Perfect Forensics

Privacy deadlines are measured in hours and days, not in the time it takes to reach certainty. CERG therefore supplies decision-grade facts: what is known, what is unknown, what is being validated, and which controls may change the notification analysis.

7. Third-Party Privacy Risk

Third parties processing personal data are assessed through CERG-PRC-TPRM-001 with privacy-specific evidence added.

Minimum vendor privacy evidence:

Vendor gaps that expose personal data become vendor-risk findings or risk-register entries.

8. Retention, Deletion, and Minimization

CERG supports retention and minimization by ensuring systems can enforce or evidence the business rule.

Requirements:

1. Systems processing personal data have a documented retention expectation.
2. Retention conflicts are escalated to the business owner and enterprise privacy process.
3. Deletion mechanisms are documented for T1/T2 and high-volume personal-data systems.
4. Backups and archives document restoration and deletion limitations.
5. Logs containing personal data are classified and retained only as long as justified.
6. New systems demonstrate minimization and deletion capability during architecture review.
7. Data that cannot be deleted on request due to legal, technical, or backup constraints has a documented rationale and evidence.

9. Evidence Library

Privacy evidence is retained under CERG-PRC-AUD-001.

10. Metrics

11. Roles and Responsibilities

Roles below are canonical role names from CERG-GOV-OM-001 §6.1.

12. Regulatory and Framework Alignment Summary

13. Document Control

Revision History

Review Triggers

• Material change to privacy law or contractual privacy obligation
• New high-risk processing activity
• Material incident involving personal data
• Material change to data governance, vendor-risk, or incident-response process
• DPIA or audit finding requiring package update
• Direction from the CISO

Cyber Governance owns this package. The Governance Pillar Leader is responsible for initiating reviews, managing the revision cycle, and obtaining CISO approval and enterprise privacy process concurrence where applicable.

Related Documents

Source: plans/CERG-PLN-PRIV-001_Privacy_and_Data_Protection_Operational_Package.md · Download .md · View on GitHub