+Airteagal 45 Aistrithe ar bhonn cinneadh leordhóthanachta
---+Airteagal 45 1.
---+Airteagal 45 2.
---+Airteagal 45 3.
---+Airteagal 45 4.
---+Airteagal 45 5.
---+Airteagal 45 6.
---+Airteagal 45 7.
---+Airteagal 45 8.
---+Airteagal 45 9.

Airteagal 45 Aistrithe ar bhonn cinneadh leordhóthanachta

-

1. Forbhreathnú

,
Airteagal 45 1.
Féadfar sonraí pearsanta a aistriú go tríú tír nó go heagraíocht idirnáisiúnta i gcás ina mbeidh cinneadh déanta ag an gCoimisiún go n-áirithíonn tríú tír, an críoch nó an earnáil shonraithe, laistigh den tríú tír sin, nó an eagraíocht idirnáisiúnta atá i gceist, go bhfuil leibhéal leordhóthanach cosanta ar fáil. Ní gá aon údarú sonrach a fháil i gcás aistriú den sórt sin.
Airteagal 45 2.

Agus a leordhóthanaí atá an leibhéal cosanta á mheas ag an gCoimisiún cuirfidh sé na nithe seo a leanas, go háirithe, san áireamh:

(a) 

an smacht reachta, an urraim do chearta an duine agus na saoirsí bunúsacha, reachtaíocht ábhartha, idir ghinearálta agus earnálach, lena n-áirítear i ndáil leis an tslándáil phoiblí, cosaint, an tslándáil náisiúnta agus an dlí coiriúil agus rochtain na n-údarás poiblí ar shonraí pearsanta, maille le cur chun feidhme na reachtaíochta seo, rialacha um chosaint sonraí, rialacha gairmiúla agus bearta slándála, lena n-áirítear rialacha maidir le sonraí pearsanta a aistriú ar aghaidh go tríú tír eile nó go heagraíocht idirnáisiúnta eile, ar rialacha iad atá á gcomhlíonadh sa tír sin nó san eagraíocht idirnáisiúnta sin, an cásdlí, chomh maith le cearta éifeachtacha in-fhorfheidhmithe a bheith ar fáil d'ábhair sonraí agus sásamh éifeachtach riaracháin agus breithiúnach do na hábhair sonraí agus a bhfuil a sonraí pearsanta á n-aistriú;

(b) 

ceann amháin nó níos mó d'údaráis neamhspleácha mhaoirseachta a bheith sa tríú tír agus é/iad ag feidhmiú go maith nó a mbeidh eagraíocht idirnáisiúnta faoina réir agus é mar fhreagracht orthu a áirithiú go bhfuil na rialacha maidir le cosaint sonraí á gcomhlíonadh agus á bhforfheidhmiú, lena n-áirítear cumhachtaí iomchuí forfheidhmithe chun comhairle a chur ar na hábhair sonraí agus cúnamh a thabhairt dóibh chuige sin, agus chun comhar a áirithiú le húdaráis mhaoirseachta an Aontais agus na mBallstát;

(c) 

na tiomantais idirnáisiúnta atá glactha ag an tríú tír nó ag an eagraíocht idirnáisiúnta lena mbaineann, nó oibleagáidí eile a eascraíonn as coinbhinsiúin nó ionstraimí atá ceangailteach ó thaobh an dlí de agus óna rannpháirtíocht i gcórais réigiúnacha nó i gcórais iltaobhacha, go háirithe a bhaineann le sonraí pearsanta a chosaint.
Airteagal 45 3.
Tar éis dó leordhóthanacht leibhéal na cosanta a mheas, féadfaidh an Coimisiún a chinneadh, trí bhíthin gníomh cur chun feidhme, go n-áirithítear i dtríú tír, i gcríoch nó in earnáil shonraithe amháin nó níos mó i dtríú tír, nó in eagraíocht idirnáisiúnta, go bhfuil leibhéal cosanta leordhóthanach inti laistigh de réir bhrí mhír 2 den Airteagal seo.Forálfar, leis an ngníomh cur chun feidhme, do shásra chun athbhreithniú tréimhsiúil a dhéanamh, ar a laghad uair amháin gach ceithre bliana, ina gcuirfear san áireamh na forbairtí ábhartha uile sa tríú tír sin nó san eagraíocht idirnáisiúnta sin. Sa ghníomh cur chun feidhme, sonrófar cur i bhfeidhm críochach agus earnálach an ghnímh, agus, i gcás inarb infheidhme, ainmneofar an t-údarás maoirseachta nó na húdaráis mhaoirseachta dá dtagraítear i bpointe (b) de mhír 2 den Airteagal seo. Glacfar an gníomh cur chun feidhme sin i gcomhréir leis an nós imeachta scrúdúcháin dá dtagraítear in Airteagal 93(2).
Airteagal 45 4.
Déanfaidh an Coimisiún, ar bhonn leanúnach, faireachán ar fhorbairtí i dtríú tíortha agus in eagraíochtaí idirnáisiúnta a bhféadfadh tionchar a bheith acu ar an gcaoi a bhfheidhmeodh na cinntí a ghlactar de bhun mhír 3 den Airteagal seo agus na cinntí a ghlactar ar bhonn Airteagal 25(6) de Threoir 95/46/CE.
Airteagal 45 5.
Sa mhéid is gá, cinnfidh an Coimisiún, i gcás ina léireoidh an fhaisnéis atá ar fáil, go háirithe tar éis an athbhreithnithe dá dtagraítear i mír 3 den Airteagal seo, nach n-áirithítear a thuilleadh leibhéal leordhóthanach cosanta i dtríú tír, i gcríoch ná in earnáil shonraithe sa tríú tír sin, ná in eagraíocht idirnáisiúnta, de bhrí mhír 2 den Airteagal seo, a mhéid is féidir, déanfaidh sé an cinneadh dá dtagraítear i mír 3 den Airteagal seo a aisghairm, a leasú nó a chur ar fionraí trí bhíthin gníomhartha cur chun feidhme gan éifeacht chúlghabhálach a bheith aige. Glacfar na gníomhartha cur chun feidhme sin i gcomhréir leis an nós imeachta scrúdúcháin dá dtagraítear in Airteagal 93(2).

Ar mhórchúiseanna práinne a bhfuil bonn cirt cuí leo, glacfaidh an Coimisiún gníomhartha cur chun feidhme atá infheidhme láithreach i gcomhréir leis an nós imeachta dá dtagraítear in Airteagal 93(3).
Airteagal 45 6.
Rachaidh an Coimisiún i gcomhairle leis an tríú tír nó leis an eagraíocht idirnáisiúnta féachaint an bhféadfaí an méid ba chúis leis an gcinneadh a rinneadh de bhun mhír 5 seo a leigheas.
Airteagal 45 7.
Ní dochar cinneadh de bhun mhír 5 den Airteagal seo d'aistrithe sonraí pearsanta go dtí an tríú tír, go críoch nó go hearnáil shonraithe amháin nó níos mó laistigh den tríú tír sin, nó go dtí an eagraíocht idirnáisiúnta a bheidh i gceist de bhun Airteagal 46 go hAirteagal 49.
Airteagal 45 8.
Déanfaidh an Coimisiún liosta a fhoilsiú, in Iris Oifigiúil an Aontais Eorpaigh agus ar a shuíomh gréasáin, de na tríú tíortha, de na críocha agus de na hearnálacha sonraithe i dtríú tír agus de na heagraíochtaí idirnáisiúnta ar chinn an Coimisiún ina leith go raibh nó nach raibh a leibhéil chosanta leormhaith.
Airteagal 45 9.
Beidh feidhm ag cinntí arna nglacadh ag an gCoimisiún ar bhonn Airteagal 25(6) de Threoir 95/46/CE go dtí go ndéanfar iad a leasú, a ionadú nó a aisghairm le Cinneadh ón gCoimisiún arna nglacadh i gcomhréir le mír 3 nó mír 5 den Airteagal seo.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
SCF Ad-Hoc Transfers

Description

Mechanisms exist to secure ad-hoc exchanges of large digital files with internal or external parties.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Data classification program
∙ Secure Baseline Configurations (SBC)
∙ Content / DNS filtering

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Data classification program
∙ Secure Baseline Configurations (SBC)
∙ Content / DNS filtering

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Data classification program
∙ Secure Baseline Configurations (SBC)
∙ Content / DNS filtering

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Data classification program
∙ Secure Baseline Configurations (SBC)
∙ Content / DNS filtering∙ Data governance program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Data classification program
∙ Secure Baseline Configurations (SBC)
∙ Content / DNS filtering∙ Data governance program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Data Classification & Handling (DCH) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with DCH domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Data management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Restrictions for ad-hoc data transfers are primarily administrative in nature (e.g., policies & standards).

Level 2 Planned Tracked

Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to document where sensitive/regulated data is stored, transmitted and/or processed.

Level 3 Well Defined

Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to secure ad-hoc exchanges of large digital files with internal or external parties.

Level 4 Quantitatively Controlled

Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF External Transfer of Sensitive / Regulated Data

Description

Mechanisms exist to restrict and govern the transfer of sensitive and/or regulated data:
(1) Cross-border; and/or
(2) Interorganizational.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Model contracts
∙ Binding Corporate Rules (BCR)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Model contracts
∙ Binding Corporate Rules (BCR)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Model contracts
∙ Binding Corporate Rules (BCR)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Model contracts
∙ Binding Corporate Rules (BCR)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Model contracts
∙ Binding Corporate Rules (BCR)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Data Classification & Handling (DCH) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Data classification and handling-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Data classification and handling management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ A formalized data classification scheme exists to identify categories of data, based on protection requirements from applicable laws, regulations and/or contractual obligations.

Level 3 Well Defined

Data Classification & Handling (DCH) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with DCH domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain DCH domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data classification and handling operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with DCH domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to restrict and govern the transfer of sensitive and/or regulated data to third-countries or international organizations.

Level 4 Quantitatively Controlled

Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Data Classification & Handling (DCH) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF Binding Corporate Rules (BCR)

Description

Mechanisms exist to implement and manage Binding Corporate Rules (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in a joint economic activity that contractually states enforceable rights on data subjects with regard to the processing of their personal data.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Data privacy program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Data privacy program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Data privacy program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Data privacy program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Data privacy program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.
▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement and manage Binding Corporate Rules (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in a joint economic activity that contractually states enforceable rights on data subjects with regard to the processing of their personal data.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Binding Corporate Rules (BCR)

Description

Mechanisms exist to implement and manage Binding Corporate Rules (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in a joint economic activity that contractually states enforceable rights on data subjects with regard to the processing of their personal data.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Data privacy program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Data privacy program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Data privacy program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Data privacy program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Data privacy program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 Well Defined

Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners.
▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement and manage Binding Corporate Rules (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in a joint economic activity that contractually states enforceable rights on data subjects with regard to the processing of their personal data.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.