Privacy Program Implementation and Operations Flashcards

What is the primary purpose of a 'privacy by default' operational setting in a product or service?

Answer: Ensure the most privacy-protective settings are active without any user action required

Privacy by default means that, out of the box, the most privacy-restrictive settings are applied, so users who take no action still receive strong privacy protection.

Which international standard provides a framework for privacy information management systems (PIMS) and can be used to certify an organization's privacy program?

Answer: ISO/IEC 27701

ISO/IEC 27701 extends ISO 27001 to address privacy requirements, providing a PIMS framework and enabling organizations to certify their privacy management practices.

A company's privacy team conducts an internal 'privacy audit' annually. What does this audit primarily assess?

Answer: Whether privacy controls are operating effectively and practices align with stated policies and applicable regulations

A privacy audit tests whether controls are actually working as designed and whether operational practices match written policies and legal requirements.

Which NIST framework provides voluntary guidance for organizations to improve their privacy risk management programs?

Answer: NIST Privacy Framework (PF) 1.0

The NIST Privacy Framework (2020) provides a voluntary, risk-based tool with Core, Profiles, and Implementation Tiers to help organizations manage privacy risks.

What is a 'privacy champion' network within an organization?

Answer: Designated employees embedded in business units who advocate for privacy practices and serve as liaisons to the central privacy team

Privacy champions extend the reach of the central privacy team by embedding privacy knowledge and accountability into individual departments across the organization.

When a privacy program is described as operating at a 'repeatable' maturity level, what does this mean?

Answer: Privacy processes are documented and consistently followed, but not yet optimized or formally measured

At the repeatable maturity level, privacy processes exist, are documented, and are followed consistently — but advanced measurement, optimization, and automation are not yet in place.