Governance and Accountability

Governance and accountability refers to the policies, procedures, and processes that an organization puts in place to ensure that its data privacy program is effective and compliant with relevant laws and regulations. It also includes the mechanisms for ensuring that individuals and teams within the organization are held accountable for meeting the organization’s privacy obligations. Without such a system in place, proving compliance, ensuring follow-through, and identifying compliance gaps are significantly more challenging.

Less Mature

A privacy program with immature governance and accountability practices has little or no formal structure for overseeing data privacy at the organization, and the individuals who are accountable for data privacy at the organization and team level is unclear or undefined. There Is likely no internal auditing of privacy policy adherence, or if there is, it is done in a retroactive manner. When internal noncompliance is identified, there may be no follow-up or remediation efforts. It may be the case that individuals who ought to be accountable for privacy in their domain are unaware of privacy policies and procedures at all.

More Mature

In contrast, mature governance and accountability practices include clear policies and procedures for handling personal data, oversight mechanisms to ensure compliance with those policies, and accountability structures to ensure that individuals and teams within the organization are held accountable for meeting their privacy obligations. The organization regularly assesses its privacy program to identify and address any gaps, and it has mechanisms in place to monitor and report on privacy risks and incidents.

Recommended Next Steps

Establishing strong governance and accountability practices can seem abstract at first, but privacy professionals can mature these practices through the following actions:

• Secure the support of senior management for the privacy program and ensure that privacy is treated as a strategic priority within the organization.
• Establish clear policies and procedures for handling personal data, along with clearly identifying responsible individuals and their responsibilities in the context of data privacy.
• Create a charter for the hierarchy, roles, responsibilities, communication strategies, and overall privacy governance structure.
• Implementing an oversight mechanism to ensure compliance with those policies and procedures, such as regular reviews and/or audits.
• Provide regular training and awareness programs to ensure that all employees are aware of their privacy obligations.
• Regularly assess and test the organization’s privacy program to identify and address any gaps.
• Monitor and report on privacy risks and incidents and share the results of that reporting with the broader organization.