Privacy Notice - Notice to Provider of Information
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
No privacy notices are provided when collecting personal data.Example Strategies
- Identify individuals within the entity who have familiarity or knowledge of points of collection of personal data who can begin an initial inventory of such activities until permanent individuals to perform formally identifying and prioritizing addressing needed privacy notices can be established.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
Informal verbal or ad-hoc written notices might be given, but they are inconsistent and lack key details.Example Strategies
- Draft a standard privacy notice for primary intake forms.
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
Standardized privacy notices exist for some data collection points, but they may not be consistently provided or fully compliant with Utah Code § 63A-19-402 and 63G-2-601.Example Strategies
- Provide a written notice at every point of personal data collection.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
Clear, comprehensive, and consistent privacy notices are provided at every point of personal data collection, detailing purpose, legal basis, and individual rights as required by Utah Code.Example Strategies
- Conduct "User Clarity" testing on all privacy notices.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity regularly audits data collection points to ensure privacy notices are consistently provided and are effective in informing individuals. Feedback mechanisms allow for notice improvement.Example Strategies
- Implement "Adaptive" personalized privacy notices.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
Privacy notices are integrated into data collection processes, potentially through interactive forms or just-in-time notifications, ensuring maximum transparency and user understanding.