Identify

Identify

Develop the organizational understanding to manage privacy risk for individuals arising from data processing.

ID.IM-P

Inventory and Mapping

ID.IM-P1

Systems/products/services that process data are inventoried.

AMP.ID.1

Does the organization have a personal data inventory?

Notes
ID.IM-P1

Systems/products/services that process data are inventoried.

AMP.ID.2

Does the organization have an inventory of systems used by business processes existing in the personal data map?

Notes
ID.IM-P2

Owners or operators (e.g., the organization or third parties, such as service providers, partners, customers, and developers) and their roles with respect to systems/products/services and components (e.g., internal or external) that process data are inventoried.

AMP.ID.3

Does the organization's data inventory list the third parties (suppliers or service providers) involved?

Notes
ID.IM-P2

Owners or operators (e.g., the organization or third parties, such as service providers, partners, customers, and developers) and their roles with respect to systems/products/services and components (e.g., internal or external) that process data are inventoried.

AMP.ID.4

Is the role of third parties (suppliers or service providers) as a processing agent described in the process?

Notes
ID.IM-P3

Categories of individuals (e.g., customers, employees or prospective employees, consumers) whose data are being processed are inventoried.

AMP.ID.5

Does the personal data inventory identify who the data subjects involved in the processes are? (e.g., customers, employees, third parties).

Notes
ID.IM-P4

All actions performed with personal data by personal data processing activities are inventoried.

AMP.ID.6

Does the data inventory contemplate their actions or activities, i.e., is there a description of the data processing?

Notes
ID.IM-P5

Are the purposes of the personal data processing activities identified?

AMP.ID.7

Does the data inventory contemplate the purposes of the personal data processing activities?

Notes
ID.IM-P6

Data elements in data actions are inventoried.

AMP.ID.8

Is there an inventory with all data involved in the processing? (e.g., ID, SSN, Driver's License)

Notes
ID.IM-P6

Data elements in data actions are inventoried.

AMP.ID.9

Does the organization's data inventory have all categories of data used by the processes? (e.g., Name; Official Documents, Personal Information)

Notes
ID.IM-P7

The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).

AMP.ID.10

Does the data inventory have the geographic location where the processing activities are performed?

Notes
ID.IM-P7

The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).

AMP.ID.11

Does the data inventory have the geographic location of the storage site of the systems involved?

Notes
ID.IM-P8

Data processing is mapped, illustrating data actions and associated data elements for systems/products/services, including components; roles of component owners/operators; and interactions of individuals or third parties with the systems/products/services.

AMP.ID.12

Does the inventory of personal data processing activities contemplate all actions performed with personal data? Does it contemplate the entire lifecycle of personal data?

Notes
ID.BE-P

Business Environment

ID.BE-P1

The organization's role in the data processing ecosystem is identified and communicated.

AMP.ID.13

Is the organization's role in the data processing ecosystem (controller, processor, or third party) identified and communicated?

Notes
ID.BE-P2

Privacy priorities are established and aligned with the organization's mission and objectives.

AMP.ID.14

Are the organization's privacy priorities aligned with its mission and objectives?

Notes
ID.BE-P3

Risk tolerance is determined and clearly expressed.

AMP.ID.15

Are the organization's privacy risk tolerance levels determined and clearly expressed?

Notes
ID.RA-P

Risk Assessment

ID.RA-P1

A privacy risk assessment methodology is established.

AMP.ID.16

Does the organization have a methodology for assessing privacy risks?

Notes
ID.RA-P2

Privacy risks to individuals are identified and documented.

AMP.ID.17

Are privacy risks to individuals identified and documented?

Notes
ID.RA-P3

Privacy risks are prioritized.

AMP.ID.18

Are privacy risks prioritized based on their impact on individuals and the organization?

Notes
ID.RA-P4

Responses to privacy risks are identified and prioritized.

AMP.ID.19

Are responses to privacy risks identified and prioritized?

Notes
ID.DE-P

Data Processing Ecosystem Risk Management

ID.DE-P1

Contracts with third parties are reviewed to ensure they meet the organization's privacy requirements.

AMP.ID.20

Are third-party data processing contracts reviewed to ensure privacy requirements are met?

Notes
ID.DE-P2

Third-party compliance with privacy requirements is monitored.

AMP.ID.21

Does the organization monitor third-party compliance with privacy requirements?

Notes