Privacy Ref Blog

Using GDPR as a framework for your privacy program (even if you are not in scope)

The privacy landscape shifts, it seems, every week. The changes may come from new laws or regulations, changes in public opinion, expansion (or contraction) of your business, or the introduction of new technology to your infrastructure. Throughout this turmoil you need to have a privacy program that is resilient, adaptable, and agile so it can take the buffeting from these shifts while continuing to provide guidance to your organization.

As you establish or improve your privacy program you have several choices to make. The responsibilities of the privacy team, the team’s structure, what to include in your policies, and how to ensure the organization is complying with your requirements are just a few of the items to consider.

You can develop a program from scratch, of course, but you can also take advantage of the work of others by basing your program on existing privacy frameworks.

What makes a good privacy framework?

A good privacy framework provides a foundation to assist you in meeting your objectives. Since objectives may vary, there are several privacy frameworks that I use with my clients.

For example, often I am asked to put together a new or revised privacy policy. I tend to use the basic principles in the OECD Privacy Framework (See Chapter 1 Part 2) as the foundation for this task. These principles are easy for an entire staff to understand and can easily be applied to your organizational requirements.

If I am interested in measuring how comprehensive a privacy program’s activities are, I tend to use Nymity Privacy Management Accountability Framework™. Using this framework I can look at a well-researched list of privacy-related activities, determine which ones fit an organization, and identify the status of the applicable activities within that organization. Usually I extend this activity to communicate expectations of the privacy office to operational areas of the organization.

If I want to determine the maturity of an organization’s privacy practices, I rely on the Generally Accepted Privacy Principles from the American Institute of Certified Public Accountants (AICPA) and Canadian Institute of Chartered Accountants (CICA).

Ultimately, selecting the proper framework depends upon what you are trying to achieve.

GDPR as a framework

The most discussed change to the privacy landscape recently is the EU’s forthcoming Global Data Protection Regulation. GDPR has a wide scope, but it does not apply to everyone (see GDPR: Do you provide goods or services in the EU?). Even if you are not in-scope, it is worthwhile to consider GDPR as the overall framework on which to build or redefine your organization’s privacy program.

Every privacy program should be based on some basic principles. GDPR specifies its basic principles in Article 5. These principles can be used as a foundation for any privacy program and include:


GDPR goes on to provide requirements for meeting these principles throughout the regulation. If you are not in-scope for GDPR, do you need to fulfill all of the requirements? No. I do suggest however, that using the requirements as a basis for defining your privacy policies and procedures is a great place to start. I am beginning to use these principles as an alternative to OECD when define privacy policies for my clients.

Transparency, for example allows the individuals you are collecting information about to understand your privacy practices. Articles 13 and 14 of GDPR provide guidance on what you should include in your privacy notice (see Privacy policy or privacy notice: what’s the difference?). The requirements are more comprehensive than many people would expect or are required in many jurisdictions. So, if you are not in-scope, you can use the GDPR list as a set of recommendations that can be adopted for your program.

GDPR also provides guidance on development (Article 25) and security (Article 32) practices. While high level, you can use the information in these articles and the associated recitals to work with your development and security teams to build privacy into their practices.

The role of the Data Protection Officer

If you use GDPR as a framework for your privacy program, one of the most helpful aspects is the description of the role of the Data Protection Officer. Whether the title of your privacy program owner is a Data Protection Officer, a Privacy Officer, or simply a Privacy Analyst, there is information in Articles 37 through 39 that may be used as a foundation for this individual’s job description. This information may also be used in setting expectations with the rest of the organization about what to expect from the privacy program owner.

  • author's avatar

    By: Bob Siegel

    Bob Siegel, the founder and President of Privacy Ref, Inc., has extensive professional experience in the development and improvement of privacy policies and procedures, the definition of performance metrics to evaluate privacy maturity, and the evaluation of compliance. He utilizes a combination of alignment, adaptability, and accountability strategies to guide organizations in achieving their privacy goals.

    He is a Fellow of Information Privacy (FIP) and a Certified Information Privacy Professional, awarded from the International Association of Privacy Professionals, with concentrations in U.S. private-sector law (CIPP/US), US public sector law (CIPP/G), European law (CIPP/E), and Canadian law (CIPP/C). He is also a Certified Information Privacy Manager (CIPM) and Privacy Technologist (CIPT).

    Siegel is a member of the IAPP faculty, has served on the Certification Advisory Board for the CIPM program the Publications Advisory Board.

    Siegel also writes the blog “Operational Privacy” on

  • author's avatar

  • author's avatar

    What you don’t know may (pleasantly) surprise you
    CNIL’s Google Fine of 50 million Euros
    In praise of a privacy compliance program
    Looking to 2019 Privacy Plans
    Preparing your customer-facing staff

    See all this author’s posts

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on March 23, 2018 by Bob Siegel

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


April 5, 2019

See you at the Summit
Visit us at Booth 500 at the IAPP Global Privacy Summit. Bob Siegel will be facilitating the CIPM course. April 30th-May 1st, 9 am - 5 pm. Meeting time available to discuss your privacy needs is available for signup here.

Latest Blog Posts

April 19, 2019

Do you have 1 minute? Check out our New weekly Quick Privacy Ref-erence series.

At Privacy Ref we are always thinking of ways to improve the experience of our followers and clients alike. Weekly on our YouTube channel you will find a relevant privacy topic being discussed in a 1-minute video such as: 

  • Cookies walls and the Dutch DPA - Ben Siegel discusses his research on the Dutch Personal Data Authorities' guidance on cookies walls and freely given consent. A cookie wall is a notice from the website, informing the user about the use of cookies on the website, without a reject option. Ben provides insight into the difference between functional cookies and tracking cookies and why the Dutch DPA's advises that websites’ basics functions are to remain available for everyone and not just for those that accept all cookies (including tracking cookies).   
Continue reading this post...

April 12, 2019

Protect Your Privacy Spring Cleaning

I’ll be honest, my blog idea was generated from an article about spring cleaning.  Let’s face it, lots of things could benefit from spring cleaning:  homes, cars, desk drawers… How about your inbox?  Maybe the ever-growing number of presentation drafts in your documents folder?  How about the flash drive in your desk drawer?  Anything in the cloud that’s been hanging out for years?  Maybe there’s a number of bookmarks or favorites on your list that hasn’t been used or accessed in a while.

Continue reading this post...

Other Recent Posts