Technology Readiness Assessment

Governance

Inventory

Personal data assessment

No inventory / visibility of personal data that applications and systems are processing. Personal data not known.Limited knowledge of personal data stored and/or processed by applications and systems. (Mainly major apps and systems.)App / system based inventory of personal data stored and/or processed by applications and systems. (Manual governance and control processes exist.)Business-unit level visibility of personal data stored and/or processed by applications and systems. (Governance and control by processes and policies, automation for personal data analysis and tagging for selected applications and systems.)Visibility and automated mapping of personal data and its lifecycle across enterprise systems and applications. Governance and automated control by processes and policies. Automated personal data analysis and tagging.

Governance

Policies

Policy-based governance

No clear or limited policy definition for data protection and data security for personal data (records management, encryption, backup, archival, and retention policies). No data protection and security policies enforcement at design or production stages.Data protection and data security policies are defined but not reviewed or enforced by the organization. Manual control and checks for policies for selected applications and systems processing personal data.Data protection and security policies for personal data processing have been defined and reviewed and are being enforced at the departmental level. Siloed solutions in place for content management, policy definitions, and enforcement at departmental level.Data protection and security policies for personal data processing have been defined and reviewed and are being enforced at the enterprise level.Enterprise-level data protection and data security policies are defined and enforced in an automated way with centralized records management, data security, and archival solutions implementations.

Data Lifecycle Management

Capture / use / share

Litigation management

Very limited / no legal proof mechanism / strategy for processing personal data. No policies defined / implemented for personal data processing and protection. Limited or no control over purpose, processing, storage, and security of data.Policies for personal data processing are defined but not reviewed or enforced by the organization. Consent, contractual-based purpose limitation, storage, archival, and data protection are implemented in an ad-hoc way for selected applications only. Limited legal proof mechanism, consent, contract, legal records permitting processing of personal data kept in ad-hoc base.Personal data processing and protection principles are defined and enforced by polices for selected / major applications. A manual legal proof mechanism (associating personal data with legal proof documents, material permitting processing of personal data) exists, but improvement is required especially from data flow mapping perspective.Legal proof mechanism for personal data processing has been established for selected / major applications and systems. Secured and protected personal data with proof of lawful basis for each processing activity, managed as records. Ongoing projects exist to transform apps and systems processing personal data to limit purpose / minimize data collected and stored.Organization ensures, carries full accountability for personal data protection and fair, lawful and transparent data processing with privacy regulation stated principles by constructing the legal base / proof: A clear consent in place, data subject is notified about purpose which is limited by consent. Only required data is collected, stored, and processed. All types of operations for personal data through its entire lifecycle are recorded and kept as proof / legal records to be shown as required.

Data Lifecycle Management

Archive / retention

Backup and recovery

No data retention or archival policies in place for personal data processing application / systems. No centralized backup and recovery policies defined / implemented.Ad-hoc based data retention and archival process for selected applications and systems processing personal data. No central policy definition, implementation / enforcement for data retention and archival. Application / system-level backup and recovery implementations in place.A manual / silo structured backup, retention, and archival process controlled at business-unit level for selected applications and systems processing personal data. Limited central policy implementation / enforcement for backup and recovery.Data backup, retention, and archival policies are implemented for selected / major applications supported by automated / semi-automated technology tools (i.e., notification / trigger mechanism for retention periods, access control / approval mechanism for archival process / access to archives).Enterprise-wide data backup, retention and archival policies are implemented with support of an automated mechanism of keeping the data for no longer than is necessary. Archival purposes-based data processing is only made by associated legal basis and implementation of appropriate safeguards.

Data Lifecycle Management

Destroy / erase

Defensible disposition

No process defined, ad-hoc based implementation of "data erasure" requests from data subjects, legal authorities, or organization itself. No request handling mechanism, manual process to search and erase personal data in each system / application.Limited data erasure policies are in place with manual / ad-hoc based implementation. No central control over data erasure process for personal data. No process defined for data erasure requests, manual request handling in IT by escalations. No proper logging mechanism for disposition.Data erasure policies are defined for selected applications and systems processing personal data, but manual implementation. Limited or no central control over data erasure process for personal data. Manual handling of data erasure / disposition logs, associating with data and request owner to have defensible basis.Data erasure policies are implemented for selected / major applications supported by automated / semi-automated technology tools. Requests for data erasure are handled by IT request management systems / teams. Logs are manually associated with data subject / owner's request.Enterprise-wide integrated with request management / IT help desk systems, enabling data subjects to remove their consent, which triggers automated erasure process for personal data. All operations are logged and automatically associated with owner / requestor.

Security

Breach detection, response & reporting

No defined process and/or technology tool for detecting security breaches, notifying / reporting to authorities—DPAs and affected data subjects. Limited or no data breach notification capability.Security monitoring and breach detection solution(s) with notification / reporting capability is implemented in an ad-hoc, limited way.Security monitoring and breach detection capability exists. Manual notification / reporting process is implemented but needs improvement to fulfill privacy standards.Given compliance to security monitoring and breach detection - Streamlined Notifications / reporting within 72 hours. Minimal information about the breach included.Given compliance to security Monitoring & Breach detection - Streamlined Notifications / reporting within 72 hours. Records of all data breaches and documentation of remedial actions are included.

Security

Data security (integrity / conf.)

Encryption

No policy-based data security by means of encryption. Selective implementation of data encryption without central key management system.Ad-hoc implementations for encryption of personal data requiring manual efforts / no key management system in place. Needs to be centralized and supported by central policies.End-to-end data-at-rest encryption is manually implemented and managed for selected applications and systems processing personal data. Pseudonymization is being investigated / in trial stage by some teams within the organization.Enterprise-level data security policies exist, defining encryption / anonymization standards for the organization. End-to-end encryption is implemented for selected / major applications and systems processing personal data.End-to-end data de-identification for personal data through its entire lifecycle (data at rest, data in motion, and data in use) is the default standard across the enterprise. Encryption keys and identities are managed and secured centrally.

Security

IT security and operations

Breach prevention

No application security strategy / policies defined or integrated into application development and quality processes for breach prevention via applications processing personal data.Application security tests are performed selectively for major applications with manual efforts. No proper integration with organization’s applications development / quality management process. Limited capability for application security testing during development stage. Ad-hoc tests for applications in production.Application security is defined and managed tests are performed selectively for major applications with manual efforts. No proper integration with organization’s applications development / quality management process. Limited capability for application security testing during development stage. Ad-hoc tests are performed for applications in production.Software security assurance is a default and integrated process of application lifecycle management. But it is enforced only for selected / major applications, due to resource and/or tooling limitations. Regular security tests are done, and remediation actions are taken both at preproduction and production stages.Software security assurance for development and operation is a default and integrated process of application lifecycle management to detect and manage vulnerabilities early in the development cycle, supported and integrated by necessary technology tools integrated into the organization’s default application quality process. Regular security tests are done and remediation actions are taken. App security is managed and enforced by enterprise-wide policies.