Record Series Privacy Annotation
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
No privacy annotations are made for record series.Example Strategies
- Identify individuals within the entity to begin identifying records series with no privacy annotation or outdated privacy annotation.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
Some ad-hoc notes or informal descriptions of personal data might exist within record series, but they are not standardized or comprehensive.Example Strategies
- Create a standardized template and guidelines for privacy annotations.
- Develop a basic template for records officers to use when annotating record series, specifying fields for "data types," "purpose of collection," and "legal authority" (even if initially brief).
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
A template for privacy annotations is provided, but completion is inconsistent, or the details are often insufficient (e.g., missing legal authority, precise data types).Example Strategies
- Mandate and provide training on comprehensive and consistent privacy annotation for all new and existing record series.
- Implement a policy requiring all new record series to be fully annotated before creation, and launch a project to review and complete annotations for existing series, providing hands-on workshops for records officers.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
All record series containing personal data are consistently annotated with required details (data types, purposes, legal authority) in a standardized format, as per Utah Code § 63A-19-401.1.Example Strategies
- Implement an auditing process for annotation completeness and accuracy.
- Establish quarterly internal audits of a sample of record series annotations to verify compliance with the standard and identify areas where data or purpose descriptions are vague, then provide targeted feedback.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity actively monitors the completeness and accuracy of privacy annotations, auditing them regularly and tracking progress towards full compliance.Example Strategies
- Implement a privacy annotation management software solution that automates privacy annotation workflows, provides a centralized repository that allows for timeframe specific assessments and analysis, and that integrates with other inventories to identify areas for proactive improvement.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
Privacy annotations are a foundational element of the entity's privacy program, integrated with data inventories and PIAs, providing a real-time, comprehensive view of personal data holdings.