Skip to main content
Home
Home

Six Phases of Compliance for a Comprehensive Privacy Program

Perkins on Privacy

Six Phases of Compliance for a Comprehensive Privacy Program

When creating a privacy program, it is important to look ahead and think strategically about who your audience might be. For businesses that might find themselves under the scrutiny of regulators and judges because of a lawsuit, unwanted publicity, or data breach, it is critical to be able to demonstrate substantial compliance for the program they've implemented. This can be accomplished by developing privacy programs that follow guidance promulgated by their audience—regulators and courts. This guidance includes the CNIL's (the French Data Protection Authority's) Six Steps for GDPR Compliance, along with Federal Trade Commission orders such as the Vizio 2017 order, which provide a roadmap for a comprehensive privacy program that can be distilled down to six main phases: Phase 1: Appoint at least one leader/task force to lead the privacy program. Phase 2: Inventory data assets and flows. Consider using CNIL's data inventory template form, available in French here. Phase 3: Conduct a gap analysis/risk assessment by benchmarking practices identified in Phase 2 with the applicable legal requirements. Phase 4: Conduct a data impact assessment for high-risk processing (e.g., data flows associated with children, medical, financial, or location data). Phase 5: Mitigate risks identified in Phases 3 and 4 by implementing appropriate policies and procedures to govern data practices, including internal governance policies and procedures, external facing policies (e.g., website, mobile app), vendor management policies, and employee training. Phase 6: Create an auditable record to demonstrate compliance. By using this roadmap, businesses can streamline compliance efforts, reduce their exposure to litigation and enforcement, and present a defensible position if faced with such a situation.


Learn More View the Full Data Management Video Series for Business Executives

Blog series

Perkins on Privacy

Perkins on Privacy keeps you informed about the latest developments in privacy and data security law. Our insights are provided by Perkins Coie's Privacy & Security practice, recognized by Chambers as a leading firm in the field. Subscribe 🡢

View the blog
Home
Jump back to top