When evaluating privacy risks, be certain to understand the legal implications that may exist based on the jurisdiction(s) where your business operates. You should be familiar with local, regional, national, and global privacy requirements. Organisations seeking to codify their privacy practices may adopt a privacy notice that outlines their privacy commitments. In some cases, laws or regulations may require that the organisation adopt a privacy notice. In addition, organisations may include privacy statements in their terms of agreement with customers and other stakeholders. ### Data Inventory Organisations often deal with many different types of sensitive and personal information. The first step in managing this sensitive data is *developing a data inventory of the types of information maintained by the organisation* and the places where that data is stored, processed, and transmitted. Organisations should include the following data types in their inventory: - **Personally identifiable information** (PII) includes any information that *uniquely identifies an individual* person, including customers, employees, and third parties. - **Protected health information** (PHI) includes *medical records* maintained by health-care providers and other organisations that are subject to the Health Insurance Portability and Accountability Act (HIPAA). - **Financial information** includes any *personal financial records* maintained by the organisation. Some of these records may be subject to the provisions of the Gramm–Leach–Bliley Act (GLBA) and/or the Payment Card Industry Data Security Standard (PCI DSS). - **Intellectual property** includes *trade secrets*, which encompass proprietary business information that provides a company with a competitive edge, such as formulas, manufacturing processes, strategies, or any other confidential information. - **Legal information** includes documents, communications, and records that are *related to legal proceedings*, contracts, or corporate governance. This might include attorney-client privileged communications, contracts, legal opinions, court records, and regulatory filings. - **Regulated information** includes any data that is *governed by laws or regulations*. This includes the regulations discussed earlier (HIPAA, GLBA, and PCI DSS), as well as any other rules governing different categories of information. ### Information Classification Information classification programs **organise data into categories based on the sensitivity of the information and the impact on the organisation** should the information be inadvertently disclosed. For example, the U.S. government uses the following four major classification categories: - **Top Secret** information requires the highest degree of protection. The unauthorised *disclosure* of Top Secret information could *reasonably be expected to cause exceptionally grave damage to national security*. - **Secret** information requires a substantial degree of protection. The unauthorised disclosure of Secret information could *reasonably be expected to cause serious damage to national security*. - **Confidential** information requires some protection. The unauthorised disclosure of Confidential information could reasonably be expected to *cause identifiable damage to national security*. - **Unclassified** information is information that does not meet the standards for classification under the other categories. Information in this category is *still not publicly releasable without authorisation*. Data classification allows organisations to clearly specify the security controls required to protect information with different levels of sensitivity. For example, the U.S. government requires the use of brightly coloured cover sheets, such as those shown below, to identify classified information in printed form. ![[Document Covers.png]] ### Data Roles and Responsibilities One of the most important things that we can do to protect our data is to *create clear data ownership policies and procedures*. Using this approach, the organisation designates specific senior executives as the data owners for different data types. For example, the vice president of Human Resources might be the data owner for employment and payroll data, whereas the vice president for Sales might be the data owner for customer information. Clear lines of data ownership place responsibility for data in the hands of executives who best understand the impact of decisions about that data on the business. They don't make all of these decisions in isolation, however. Data owners delegate some of their responsibilities to others in the organisation and also rely on advice from subject matter experts (SMEs), such as cybersecurity analysts and data protection specialists. You should be familiar with other important data [[Data Governance|privacy roles]]. ### Information Life Cycle Data protection should continue at all stages of the information life cycle, from the time the data is originally collected until the time it is eventually disposed of. At the early stages of the data life cycle, organisations should practice **data minimisation**, where they *collect the smallest possible amount of information necessary* to meet their business requirements. Information that is not necessary should either be immediately discarded or, better yet, not collected in the first place. Although information remains within the care of the organisation, the organisation should practice **purpose limitation**. This means that information *should be used only for the purpose that it was originally collected* and that was consented to by the data subjects. >[!done] Right to Be Forgotten >The right to be forgotten, also known as the right to erasure, is a concept that has been implemented in various data protection laws, notably the European Union's GDPR. > The right to be forgotten allows **individuals to request the deletion of personal data about them under certain circumstances**. Under GDPR, individuals can request erasure if: > >- The data is no longer needed for its original purpose. >- The individual withdraws consent. > >- The individual objects and there is no overriding legitimate interest to continue processing. > >- The data has been unlawfully processed. > >- There is a legal obligation to erase the data. > The principle behind this right is that outdated or incorrect information can be harmful or misleading and individuals should have some degree of control over their personal information online, particularly in the age of digitalisation and vast data storage capabilities. > Implementing the right to be forgotten can be challenging from both technical and procedural standpoints. Businesses need to have proper mechanisms in place to identify and erase data when requested. At the end of the life cycle, the organization should implement **data retention standards** that guide the end of the data life cycle. Data should only be kept for *as long as it remains necessary to fulfil the purpose* for which it was originally collected. At the conclusion of its life cycle, data should be securely destroyed.