Statewide Privacy Training
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
Records officers receive no specialized records management or privacy training or certification.Example Strategies
- Confirm existence of and best practices for trainings offered by State Archives.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
Records officers may attend occasional, general training sessions, but no formal certification process or consistent privacy-focused training exists.Example Strategies
- Identify the required State Archives training modules and add them to the onboarding checklist for new records officers.
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
Records officers are encouraged to get certified, and basic privacy training materials are available, but ongoing, specific privacy training is inconsistent.Example Strategies
- Mandate and certify annual GRAMA training for all Records Officers.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
All records officers are certified and receive consistent, documented training specifically tailored to Utah's privacy laws and their privacy responsibilities.Example Strategies
- Audit the real-world application of training through classification spot-checks.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity tracks records officer certification status, training completion rates, and assesses the effectiveness of training through quizzes or practical exercises.Example Strategies
- Implement adaptive, role-specific privacy and records training.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
Records officers are empowered to be privacy champions, actively participating in advanced privacy education, sharing best practices, and mentoring other staff.