Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• PRI-39_A01 the time period within which data subject rights requests are to be acknowledged is defined.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26_ODP[01]
• PRI-39_A02 the time period within which data subject rights requests are to be fulfilled is defined.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26_ODP[02]
• PRI-39_A03 a process to receive and acknowledge data subject rights requests is implemented.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26[01]
• PRI-39_A04 a process to fulfill data subject rights requests in accordance with applicable statutory, regulatory and/or contractual obligations is implemented.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26[02]
• PRI-39_A05 one or more publicly accessible and easy to use channels are provided for data subjects to submit rights requests.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26a.[01]
• PRI-39_A06 the identity of the data subject, or their authorized agent, is validated before a data subject rights request is fulfilled.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26b.
• PRI-39_A07 data subject rights requests are tracked from receipt through fulfillment or denial.
  Assessment rigor: 1
  Origin: 53A_R5_PM-26c.[01]
• PRI-39_A08 records of each data subject rights request, including the validation performed, the action taken and the date of response, are retained.
  Assessment rigor: 2
  Origin: 53A_R5_PM-26c.[02]
• PRI-39_A09 receipt of data subject rights requests is acknowledged to the data subject within the organization-defined time period.
  Defined parameters: within ten (10) business days of receipt
  Assessment rigor: 2
  Origin: 53A_R5_PM-26d.
• PRI-39_A10 data subject rights requests are fulfilled, or denied with the reason for denial communicated to the data subject, within the organization-defined time period.
  Defined parameters: within one (1) month of receipt, extendable only where permitted by applicable law
  Assessment rigor: 2
  Origin: 53A_R5_PM-26e.
• PRI-39_A11 the statutory, regulatory and/or contractual obligations applicable to data subject rights requests are identified.
  Assessment rigor: 1
  Origin: SCF Created

Linkitetyt tehtävät

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.