Management commitment (5.1)
Top management must ensure that privacy objectives fit the strategy, that the system has resources and that it is built into business processes rather than left in a compliance folder.
Privacy policy (5.2)
This is the system’s internal policy, not the legal notice on the website. It records the commitment to meet applicable privacy requirements and to improve the system, and it provides the framework for setting objectives.
Roles and authorities (5.3)
Someone must be named as accountable for the system meeting the standard and for reporting to top management. Where there is a data protection officer, their role and independence must fit with that assignment, without mistaking them for the system owner.
What an auditor usually asks for
- A privacy policy that is approved, communicated and available
- A PIMS responsibility matrix
- Appointment of the data protection officer, where required
- Evidence of the resources allocated to the system
How to cover leadership in Kimobox
- 1Publish the privacy policy as a controlled document, with read acknowledgement.
- 2Assign an owner to every processing activity and every risk directly in the system.
- 3Prepare the management review with the period’s breaches and requests already loaded.
Read acknowledgement proves the policy has reached the people who handle the data.