Requirement
The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity’s objectives related to privacy.
Points of Focus
Creates and Retains Record of Authorized Disclosures [P][C]
Requirement: The entity creates and maintains a record of authorized disclosures of personal information that is complete, accurate, and timely.
Explanation
Every time personal information is legitimately shared with a third party, that disclosure must be logged: what was shared, with whom, and when. Auditors sample this record to confirm it is complete, accurate, and kept up to date, because without it the organization cannot account for where personal data has gone.
