Monitoring and measurement (9.1)
Good indicators are the ones drawn from the records: rights requests answered on time, breaches per quarter and their time to notification, processors with a contract in force, training completed.
Internal audit (9.2)
The programme covers the clauses and the applicable controls, with auditors who do not review their own work. Auditing a sample of rights requests from start to finish tells you more than reading the procedure.
Management review (9.3)
Its inputs include legal and contextual changes, audit results, indicators and breaches. Its outputs are decisions on improvement and change, and they are kept as evidence.
What an auditor usually asks for
- A privacy indicator dashboard
- An internal audit programme and reports
- Management review minutes with their decisions
- Follow-up of the resulting actions
How to cover evaluation in Kimobox
- 1Calculate indicators from the rights, breach and processor records.
- 2Plan the audit programme and log the findings in the same system.
- 3Generate the management review with the period’s data already loaded.
Indicators are not filled in by hand before the review: they come straight from the records.