CAO-300 Privacy — Domain ECF

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-311 Privacy Notice and Transparency › CAO-3111 Provide a clear and current privacy notice › CAO-31111 Clear, current and accessible privacy notice provided describing the processing, its purposes and data-subject rights.

CAO-311111 · Examine the privacy notice to confirm it is current, accessible and describes processing and rights.

Method: Examine · Expected evidence: Published privacy notice

Operational controls: CAO-3111111 Privacy Notice — template

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-312 Obtaining Consent › CAO-3121 Obtain valid consent for processing › CAO-31211 Valid, freely given, specific and informed consent obtained and recorded where processing relies on consent.

CAO-312111 · Examine consent records to confirm consent is valid, specific and recorded.

Method: Examine · Expected evidence: Consent records

Operational controls: CAO-3121111 Consent Register

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-313 Consent Withdrawal and Choice › CAO-3131 Enable withdrawal of consent and exercise of choice › CAO-31311 Mechanisms provided to withdraw consent and exercise choice as easily as consent was given.

CAO-313111 · Examine consent-withdrawal mechanisms to confirm withdrawal is enabled and actioned.

Method: Examine, test · Expected evidence: Withdrawal records

Operational controls: CAO-3131111 Consent Withdrawal Work Instruction

CAO-300 Privacy › CAO-310 Consent Management Policy › CAO-314 Marketing and Opt-Out › CAO-3141 Honour opt-out of sale, sharing and direct marketing › CAO-31411 Opt-out of sale, sharing and direct marketing honoured, and preferences maintained.

CAO-314111 · Examine opt-out handling to confirm requests are honoured and preferences maintained.

Method: Examine · Expected evidence: Opt-out and preference records

Operational controls: CAO-3141111 Marketing Preference Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-321 Right of Access › CAO-3211 Provide data subjects access to their personal information › CAO-32111 Data subjects provided access to their personal data and information about its processing.

CAO-321111 · Examine access-request handling to confirm requests are fulfilled within mandated timeframes.

Method: Examine · Expected evidence: Access-request records

Operational controls: CAO-3211111 Data Subject Access Request Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-322 Rectification and Erasure › CAO-3221 Enable rectification and erasure of personal data › CAO-32211 Rectification and erasure of personal data enabled on valid request.

CAO-322111 · Examine rectification and erasure handling to confirm valid requests are actioned.

Method: Examine · Expected evidence: Rectification and erasure records

Operational controls: CAO-3221111 Rectification and Erasure Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-323 Restriction, Objection and Portability › CAO-3231 Honour rights to restriction, objection and data portability › CAO-32311 Rights to restriction, objection and data portability honoured.

CAO-323111 · Examine handling of restriction, objection and portability requests to confirm they are honoured.

Method: Examine · Expected evidence: Restriction, objection and portability records

Operational controls: CAO-3231111 Data Rights Request Register

CAO-300 Privacy › CAO-320 Data Subject Rights Policy › CAO-324 Non-Discrimination and Complaints › CAO-3241 Ensure non-discrimination and handle complaints › CAO-32411 Non-discrimination ensured for the exercise of privacy rights, and complaints handled and resolved.

CAO-324111 · Examine complaint records to confirm complaints are handled and resolved without discrimination.

Method: Examine · Expected evidence: Complaint records and resolutions

Operational controls: CAO-3241111 Privacy Complaints Register

CAO-300 Privacy › CAO-330 Privacy by Design Policy › CAO-331 Privacy by Design and Default › CAO-3311 Embed privacy by design and by default across systems and processing › CAO-33111 Privacy embedded by design and by default across systems, products and processing activities.

CAO-331111 · Examine design and data-protection impact-assessment records to confirm privacy is embedded by design and default.

Method: Examine · Expected evidence: DPIA and privacy-by-design records

Operational controls: CAO-3311111 Privacy by Design Assessment Template

CAO-300 Privacy › CAO-340 Information Classification Policy › CAO-341 Information Classification › CAO-3411 Classify information according to its sensitivity and value › CAO-34111 Information classified according to its sensitivity, value and legal requirements.

CAO-341111 · Examine the classification scheme and classified assets to confirm consistent classification.

Method: Examine · Expected evidence: Classification scheme and classified inventory

Operational controls: CAO-3411111 Information Classification Scheme

CAO-300 Privacy › CAO-340 Information Classification Policy › CAO-342 Information Labelling › CAO-3421 Label information in line with its classification › CAO-34211 Information labelled in line with its classification across formats and media.

CAO-342111 · Examine labelling practices to confirm information is labelled per its classification.

Method: Examine · Expected evidence: Labelling procedure and samples

Operational controls: CAO-3421111 Information Labelling Work Instruction

CAO-300 Privacy › CAO-350 Information Transfer Policy › CAO-351 Information Transfer › CAO-3511 Transfer information securely within and outside the organisation › CAO-35111 Information transferred securely within and outside the organisation under agreements and protective controls.

CAO-351111 · Examine transfer agreements and controls to confirm secure transfer of information.

Method: Examine · Expected evidence: Transfer agreements and protection evidence

Operational controls: CAO-3511111 Information Transfer Agreement Template

CAO-300 Privacy › CAO-360 Records Management Policy › CAO-361 Records of Processing › CAO-3611 Maintain records of processing activities › CAO-36111 Records of processing activities maintained and kept current.

CAO-361111 · Examine the records of processing to confirm they are maintained and current.

Method: Examine · Expected evidence: Records of processing activities

Operational controls: CAO-3611111 Records of Processing Activities Register

CAO-300 Privacy › CAO-360 Records Management Policy › CAO-362 Records Retention and Documentation › CAO-3621 Retain and protect records in line with retention obligations › CAO-36211 Records retained and protected in line with retention obligations, then securely disposed.

CAO-362111 · Examine the retention schedule and records to confirm retention obligations are met.

Method: Examine · Expected evidence: Records retention schedule and disposal records

Operational controls: CAO-3621111 Records Retention Schedule

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3711 Establish a lawful basis for processing personal data › CAO-37111 A lawful basis identified and documented for each processing activity.

CAO-371111 · Examine processing records to confirm a lawful basis is identified for each activity.

Method: Examine · Expected evidence: Lawful basis register

Operational controls: CAO-3711111 Lawful Basis Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3712 Apply additional safeguards for special-category data › CAO-37121 Additional safeguards and conditions applied to special-category and sensitive personal data.

CAO-371211 · Examine processing of special-category data to confirm additional conditions and safeguards are met.

Method: Examine · Expected evidence: Special-category processing records

Operational controls: CAO-3712111 Special Category Data Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-371 Lawful Basis for Processing › CAO-3713 Uphold the principles of lawful and fair processing › CAO-37131 Processing conducted lawfully, fairly and transparently in line with data-protection principles.

CAO-371311 · Examine processing practices to confirm alignment with lawful, fair and transparent principles.

Method: Examine · Expected evidence: Processing assessment records

Operational controls: CAO-3713111 Data Protection Principles Assessment

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3721 Minimise personal data to what is necessary › CAO-37211 Personal data limited to what is adequate, relevant and necessary for the purpose.

CAO-372111 · Examine data collection and storage to confirm minimisation to necessary data.

Method: Examine · Expected evidence: Data minimisation records

Operational controls: CAO-3721111 Data Minimisation Assessment

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3722 Limit processing to specified, explicit purposes › CAO-37221 Processing limited to specified, explicit and legitimate purposes.

CAO-372211 · Examine purpose specifications to confirm processing is limited to stated purposes.

Method: Examine · Expected evidence: Purpose specification records

Operational controls: CAO-3722111 Processing Purpose Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-372 Data Minimisation and Limitation › CAO-3723 Limit the retention of personal data › CAO-37231 Personal data retained only as long as necessary for the purpose, then deleted.

CAO-372311 · Examine retention controls to confirm personal data is retained only as long as necessary.

Method: Examine · Expected evidence: Personal data retention records

Operational controls: CAO-3723111 Personal Data Retention Schedule

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-373 Cross-Border Data Transfers › CAO-3731 Govern cross-border transfers of personal data › CAO-37311 Cross-border transfers of personal data governed by lawful transfer mechanisms and safeguards.

CAO-373111 · Examine transfer mechanisms to confirm cross-border transfers use lawful safeguards such as adequacy or standard clauses.

Method: Examine · Expected evidence: Transfer mechanism records

Operational controls: CAO-3731111 Cross-Border Transfer Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-374 Personal Data Breach Notification › CAO-3741 Notify personal data breaches to regulators and data subjects › CAO-37411 Personal data breaches assessed and notified to regulators and data subjects within mandated timeframes.

CAO-374111 · Examine breach records to confirm assessment and timely notification to required parties.

Method: Examine · Expected evidence: Breach assessment and notification records

Operational controls: CAO-3741111 Personal Data Breach Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-375 Data Quality and Protection › CAO-3751 Maintain the accuracy and quality of personal data › CAO-37511 Personal data kept accurate and up to date, with inaccuracies corrected.

CAO-375111 · Examine data-quality controls to confirm accuracy is maintained and corrections actioned.

Method: Examine · Expected evidence: Data-quality and correction records

Operational controls: CAO-3751111 Data Quality Register

CAO-300 Privacy › CAO-370 Data Protection and Privacy Policy › CAO-375 Data Quality and Protection › CAO-3752 Protect records and personally identifiable information › CAO-37521 Records and personally identifiable information protected against loss, misuse and unauthorised access.

CAO-375211 · Examine protection controls for records and PII to confirm protection against loss and misuse.

Method: Examine · Expected evidence: PII protection configuration and records

Operational controls: CAO-3752111 PII Protection Register