1 · Purpose
This policy establishes the requirements for data protection and privacy policy within the CAO-300 Privacy. It gives effect, in a single harmonised instrument, to the control objectives upon which recognised standards converge for this area.
2 · Scope
This policy applies to all information, systems, services, personnel and third parties within the scope of the management system.
3 · Policy statements
3.x · CAO-370 Policy Controls
The organisation shall establish, implement and maintain a coherent and effective approach to data protection and privacy, giving effect to the organisational control objectives set out below.
3.1 · CAO-371 Lawful Basis for Processing
The organisation shall establish, implement and maintain effective Lawful Basis for Processing, giving effect to the organisational controls set out below.
3.1.x · CAO-371 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.2 · CAO-372 Data Minimisation and Limitation
The organisation shall establish, implement and maintain effective Data Minimisation and Limitation, giving effect to the organisational controls set out below.
3.2.x · CAO-372 Organisational Controls
Essential taster — a preview of the Professional depth for this high-density control area.
3.3 · CAO-373 Cross-Border Data Transfers
The organisation shall establish, implement and maintain effective Cross-Border Data Transfers, giving effect to the organisational controls set out below.
3.3.x · CAO-373 Organisational Controls
3.4 · CAO-374 Personal Data Breach Notification
The organisation shall establish, implement and maintain effective Personal Data Breach Notification, giving effect to the organisational controls set out below.
3.4.x · CAO-374 Organisational Controls
3.5 · CAO-375 Data Quality and Protection
The organisation shall establish, implement and maintain effective Data Quality and Protection, giving effect to the organisational controls set out below.
3.5.x · CAO-375 Organisational Controls
4 · Roles & responsibilities
- Governing body — approves this policy and oversees its effectiveness.
- Executive management — allocates resources and assigns control ownership.
- Control owners — implement, operate and evidence the controls in their area.
- All personnel & third parties — comply with this policy within their role.
5 · Compliance, monitoring & review
Compliance with this policy is mandatory. This policy is reviewed at least annually, or upon significant change to the threat, regulatory or technological environment. Exceptions require documented risk acceptance by the accountable owner.