Privacy Program Report
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
No privacy program report is completed. The responsibility for completing the report is not established. The requirements mandated by statute are unknown.Example Strategies
- Identify an individual who can address an initial privacy program report while a permanent accountable individual is identified and established.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
A privacy program report may be completed, but the ongoing responsibility remains unestablished. The report may have been completed but there is no determination of its thoroughness or whether all requirements for the report were met.Example Strategies
- Create a preliminary data collection plan for the annual report.
- Select a reporting template (e.g., the Office of Data Privacy draft) and begin identifying high-risk processing activities.
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
A privacy program report is completed. There is a general understanding of the responsibility for its completion.Example Strategies
- Formally submit the annual report to the Office of Data Privacy by December 31.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
The entity has a formal, documented process for completing and submitting the privacy program report. The privacy program report is appropriately maintained, allows for reference and comparison, and may contain additional data points that are relevant for the entity in addition to what is statutorily required.Example Strategies
- Use multi-year report data to drive strategic privacy improvements.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity uses the privacy program reports to conduct assessments and analysis to inform areas for improvement and address potential risks before an issue develops.Example Strategies
- Automate real-time compliance reporting via a live dashboard.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.