The Privacy Insider, Continued

Privacy Work Is Never Done

"The Privacy Insider" Digital Appendix

Now that you’ve read “The Privacy Insider: How to Embrace Data Privacy and Join the Next Wave of Trusted Brands” by Arlo Gilbert, you might be looking for a few extra resources for your privacy program journey.

As a result, we’ve built this digital appendix, complete with several of Osano’s free guides on everything from privacy programs and data privacy laws to assessments and data mapping.

The Osano Privacy Program Maturity Model

Measuring Your Privacy Program's Success

As you develop your privacy program, it can be hard to know if you’re headed in the right direction.

With the Osano Privacy Program Maturity Model, you’ll not only gain information on each element of a privacy program, but you’ll also be able to score your program, identify which elements represent the biggest gap in your program, and use the recommended next steps to determine where to go next. Use the model to then track your program’s growth over time so you know your next steps as your organization evolves.

Learn the Language

There are a myriad of words and phrases within the realm of data privacy, and it can be hard to wade through it all.

In this glossary, we’ve provided some of the most commonly used acronyms, categories of people and organizations, compliance concepts, legal terms, and more so you don’t have to open the dictionary every time a new data privacy law is released.

Creating Clarity With Privacy Policies

Privacy policies tell consumers about what types of data you collect, how you collect it, the purpose of and legal basis for that collection, as well as what their rights are, how long you’ll keep their data, who you share it with, and your security measures for keeping it safe. 

Our comprehensive checklist tells you everything you need to know to create your own, and it provides you with a few examples to review.  

GDPR Compliance

The European Union became one of the main leaders in data privacy when the General Data Protection Regulation (GDPR) came into effect in May of 2018. With it came several principles privacy professionals are familiar with today, such as subject rights, privacy by design, data minimization, records of processing activities, and more.

U.S. Data Privacy

Since California introduced the California Consumer Privacy Act (CCPA) in 2020 (more on that below), several privacy laws have popped up in individual states across the country. We’ve developed several guides to help you prepare, starting with the U.S. Data Privacy Law Guide.

California: The First U.S. Comprehensive Data Privacy Law

California established the first comprehensive data privacy law in the United States when it passed the CCPA in 2018. The state then upped the stakes with its addition to the law—the California Privacy Rights Act (CPRA), which was passed in 2020 and came into effect on January 1, 2023. It is currently one of the strongest data privacy laws in the United States. Learn more about how to comply with the law with our Survival Guide.

Data Mapping

To truly grasp what you’re collecting, how much of it you have, and where it is across your organization, you need a data map. This way, when you do get started on more downstream privacy-related tasks—like the assessments listed below—you’ll already have a handle on one of the most difficult aspects of the task at hand. Get started with our free checklist:

Records of Processing Activities

The GDPR introduced a new term, “Record of Processing Activity”—also known as a RoPA—in its Article 30. With this article, RoPAs became a requirement for each controller to maintain.

What exactly is a RoPA? It’s a document that outlines all of your business’s data processing activities, from HR and marketing to third-party activities and cross-border data transfers. Learn about everything that goes into one in our guide below.  

Privacy Assessments

Businesses are no stranger to assessments. There are assessments in almost every aspect of business, and the same can be said for data privacy. Privacy risk assessments, such as data protection impact assessments (DPIAs) and privacy impact assessments (PIAs), are often a staple in data privacy laws. Meanwhile, vendor privacy assessments can help you determine if there are privacy risks associated with a new third-party vendor.