1 · Purpose
This policy establishes the requirements for consent management policy within the CAO-300 Privacy. It gives effect, in a single harmonised instrument, to the control objectives upon which recognised standards converge for this area.
2 · Scope
This policy applies to all information, systems, services, personnel and third parties within the scope of the management system.
3 · Policy statements
3.x · CAO-310 Policy Controls
The organisation shall establish, implement and maintain a coherent and effective approach to consent management, giving effect to the organisational control objectives set out below.
3.1 · CAO-311 Privacy Notice and Transparency
The organisation shall establish, implement and maintain effective Privacy Notice and Transparency, giving effect to the organisational controls set out below.
3.1.x · CAO-311 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.2 · CAO-312 Obtaining Consent
The organisation shall establish, implement and maintain effective Obtaining Consent, giving effect to the organisational controls set out below.
3.2.x · CAO-312 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.3 · CAO-313 Consent Withdrawal and Choice
The organisation shall establish, implement and maintain effective Consent Withdrawal and Choice, giving effect to the organisational controls set out below.
3.3.x · CAO-313 Organisational Controls
3.4 · CAO-314 Marketing and Opt-Out
The organisation shall establish, implement and maintain effective Marketing and Opt-Out, giving effect to the organisational controls set out below.
3.4.x · CAO-314 Organisational Controls
4 · Roles & responsibilities
- Governing body — approves this policy and oversees its effectiveness.
- Executive management — allocates resources and assigns control ownership.
- Control owners — implement, operate and evidence the controls in their area.
- All personnel & third parties — comply with this policy within their role.
5 · Compliance, monitoring & review
Compliance with this policy is mandatory. This policy is reviewed at least annually, or upon significant change to the threat, regulatory or technological environment. Exceptions require documented risk acceptance by the accountable owner.