Data Subject Requests for an Explanation

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    Individuals are not provided with explanations regarding data processing.

    Example Strategies

    • Identify individuals who can perform such functions in an ad hoc or as needed basis until permanent individuals are appointed.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Explanations might be given informally on a case-by-case basis, lacking standardization.

    Example Strategies

    • Create "FAQs" for staff handling data collection.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    Some general information about data processing might be available on the entity's website, but direct, specific explanations for individual data processing are not consistently provided upon request.

    Example Strategies

    • Mandate that staff provide a clear explanation of uses upon request.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    A formal process is established to provide clear and comprehensive explanations to individuals regarding how their personal data is processed, its purposes, and the legal basis, upon request.

    Example Strategies

    • Monitor explanation request frequency to simplify forms.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity tracks the types of explanation requests received and the clarity/completeness of responses, using feedback to improve public-facing privacy information and internal training.

    Example Strategies

    • Deploy a Generative AI chatbot for context-specific explanations.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    Interactive tools or dedicated privacy liaisons are available to provide personalized explanations, empowering individuals with a deep understanding of their data's lifecycle within the entity.