| Complaints including file reviews |
| Create “record of authority” of systems processing personal information within the organization |
|
| Review contractual and data sharing obligations |
| Risk and control alignment |
| Post integration planning and risk mitigation |
| Integrate privacy through business processes |
| Communicate with stakeholders the importance of PIAs and PbD |
| Determine and implement guidelines for secondary uses (ex: research, etc.) |
| Define policies related to the processing (including collection, use, retention, disclosure and disposal) of organization’s data holdings, taking into account both legal and ethical requirements |
| Implement appropriate administrative safeguards, such as policies, procedures, and contracts |
| Utilize and report on regulator compliance assessment tools |
| Complaints including file reviews |
|
|
| Perform containment activities |
| Identify and implement remediation measures |
| Notify regulator, impacted individuals and/or the responsible data controller |
