Requirement
The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy.
Points of Focus
Responds to Data Controller Requests [P]
Requirement: The entity has a process to respond to data controller requests for an accounting of personal information held in accordance with service agreements and privacy objectives.
Identifies Types of Personal Information and Handling Process [P][C]
Requirement: The types of personal information and sensitive personal information and the related processes, systems, and third parties involved in the handling of such information are identified.
Captures, Identifies, and Communicates Requests for Information [P][C]
Requirement: Requests for an accounting of personal information held and disclosures of the data subjects’ personal information are captured and information related to the requests is identified and communicated to data subjects to support the achievement of the entity’s objectives related to privacy.
Explanation
Individuals can ask what personal information the organization holds about them and to whom it has been disclosed. Auditors verify there is a process to identify the data and systems involved, capture such requests, and provide a complete, timely accounting back to the data subject or data controller.
