Website Privacy Notice and Website Privacy Policy
Maturity Level
Level 0: Non-Existent
The practice is not implemented or acknowledged.
No website privacy policy exists.Example Strategies
- Identify individuals within the entity who have familiarity or knowledge of websites that collect user data who can begin an initial inventory of such activities until permanent individuals to formally identify and prioritize addressing needed website privacy notices can be established.
Level 1: Ad Hoc
Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
A generic privacy policy might be present but is not tailored to the entity's specific data practices or Utah Code.Example Strategies
- Draft a Utah-specific website privacy notice.
Level 2: Defined
Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
A website privacy policy exists, but it may be difficult to find, contain outdated information, or lack specific details required by Utah Code § 63D-2-103.Example Strategies
- Prominently post a notice including ombudsperson complaint info.
Level 3: Consistently Implemented
Practice is documented to cover all relevant aspects, application is formal and consistent.
The website privacy policy is clear, comprehensive, easily accessible, accurately reflects the entity's data practices, and is consistently reviewed and updated to comply with Utah Code.Example Strategies
- Monitor website analytics for privacy notice engagement.
Level 4: Managed
Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
The entity monitors user engagement with the privacy policy (e.g., page views) and actively seeks feedback to ensure clarity and user understanding. Regular audits confirm policy accuracy.Example Strategies
- Implement a dynamic "Data Processing Map" on the website.
Level 5: Optimized
Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
The website privacy policy is dynamically generated or highly interactive, providing users with granular control over their data preferences and direct links to relevant privacy information or request forms.