Data Subject Requests by At-Risk Employees for Restricting Access

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    No process exists for at-risk employees to restrict their personal information.

    Example Strategies

    • Identify individuals who can perform such functions in an ad hoc or as needed basis until permanent individuals are appointed.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    There's an informal awareness of the need to protect certain employee data, but no specific process or form for at-risk employees to make formal requests.

    Example Strategies

    • Identify the statutory form for at-risk employees.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    A basic form or procedure exists for at-risk employees, but it might not fully align with Utah Code § 63A-19-303, or the process for applying restrictions is inconsistent.

    Example Strategies

    • Maintain and process at-risk employee forms for a 4-year period.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    A formal, clear, and consistently applied process, including a specific form, is in place for at-risk governmental employees to request the classification of their personal information as private, adhering fully to Utah Code § 63A-19-303.

    Example Strategies

    • Audit restricted fields across all integrated systems.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity tracks the number of such requests, the types of data restricted, and the efficiency of the restriction implementation process, ensuring compliance and employee protection.

    Example Strategies

    • Automate real-time "At-Risk" masking across the enterprise.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    The entity proactively educates at-risk employees about their rights and the process for requesting restrictions, integrating these protections into broader employee privacy and security protocols.