Privacy Ref Blog

In praise of a privacy compliance program

Opening my newsfeed this morning I was not surprised to find an article about another data breach. Over the coming days I am sure we will discover that the organization’s policies were well defined, that training and awareness had taken place, and it was just that the procedures weren’t followed by one individual. The skeptic in me would say that if one person isn’t following procedures, there are probably others. To prevent situations like these, an organization must establish a privacy compliance regimen.

Compliance verification may not be exciting…

When I discuss privacy with my clients and my students, there is always a focus on the new law, the new technology, or the latest breach. Conversations usually turn to how policies and procedures will be impacted or how an awareness campaign needs to be established. These are all important discussions you should have. After all, it is where the excitement is in privacy. 

I try to steer the conversation by asking the question “how do you know your policies are being followed?” It is not unusual to hear that an informal approach is taken. Organizations rely on self-reporting by managers that there may be an issue, they rely on an ethics hot line for receiving anonymous reports, or they contend that Internal Audit or some other department has that oversight role.

Occasionally I here about a Privacy Impact Assessment process to provide the compliance review function. Sure, a PIA process may provide some insight, but how often does your privacy team conduct PIAs once a system or process is deployed?

…and it has costs…

Let’s face it, doing compliance verification is not a lot of fun. Like any audit or assessment, it takes time to plan and execute. It will take resources away from the organization’s daily, mission-centric activities. 

Plus, where do you start? Which of the departments do you look at first? What about the data processors? What other activities will need to stop in the privacy office to perform the reviews? And, of course, who is going to pay for it?

…but you are accountable.

If everything is working perfectly, deprecating compliance reviews may make sense. However I have yet to see an organization where there is not a department that has, let’s say, lessened the focus on privacy policies and procedures for the sake of operational efficiency.. 

It is important to note that modern privacy laws are requiring that education be provided for privacy policies as well as that an organization ensure that the laws are being met. For example, GDPR Article 39(2) says that a Data Protection Officer should “…monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

Then some incident occurs. The operational area involved claims they are doing their job and did not know they had privacy issues. Senior management wants to know why someone was not aware of the situation.  Regulators are knocking at the door as is the media. All eyes turn to the Privacy Officer.

Take the first step

Lack of compliance reviews exposes your organization to legal and reputation risk. Putting a compliance program in place with a combination of audits, assessments, and attestations will help reduce this exposure.

Start by risk ranking all the different departments, including data processors, who access personal information. If there is high risk in one area, consider performing an audit. If it is low risk, maybe attestation is sufficient. 

With limited resources, an approach to take is to review the riskiest areas plus two or three other departments on a rotating basis. Over time, you will cover your entire organization.

  • author's avatar

    By: Bob Siegel

    Bob Siegel, the founder and President of Privacy Ref, Inc., has extensive professional experience in the development and improvement of privacy policies and procedures, the definition of performance metrics to evaluate privacy maturity, and the evaluation of compliance. He utilizes a combination of alignment, adaptability, and accountability strategies to guide organizations in achieving their privacy goals. He is a Fellow of Information Privacy (FIP) and a Certified Information Privacy Professional, awarded from the International Association of Privacy Professionals, with concentrations in U.S. private-sector law (CIPP/US), US public sector law (CIPP/G), European law (CIPP/E), and Canadian law (CIPP/C). He is also a Certified Information Privacy Manager (CIPM) and Privacy Technologist (CIPT). Siegel is a member of the IAPP faculty, has served on the Certification Advisory Board for the CIPM program the Publications Advisory Board. Siegel also writes the blog “Operational Privacy” on

  • author's avatar

  • author's avatar

    What you don’t know may (pleasantly) surprise you
    CNIL’s Google Fine of 50 million Euros
    Looking to 2019 Privacy Plans
    Preparing your customer-facing staff
    Automation for Privacy

    See all this author’s posts

Privacy Ref provides consulting and assessment services to build and improve organizational privacy programs. For more information call Privacy Ref at (888) 470-1528 or email us at

Posted on February 1, 2019 by Bob Siegel

« »

No Responses

Comments are closed.

« »

Subscribe to our mailing list

Please fill out the form below.


Want to find out more?

Simply go to the contact page, fill out the form, and someone from Privacy Ref will be in touch with you. You can also send an email to or call (888) 470-1528.


April 5, 2019

See you at the Summit
Visit us at Booth 500 at the IAPP Global Privacy Summit. Bob Siegel will be facilitating the CIPM course. April 30th-May 1st, 9 am - 5 pm. Meeting time available to discuss your privacy needs is available for signup here.

Latest Blog Posts

April 19, 2019

Do you have 1 minute? Check out our New weekly Quick Privacy Ref-erence series.

At Privacy Ref we are always thinking of ways to improve the experience of our followers and clients alike. Weekly on our YouTube channel you will find a relevant privacy topic being discussed in a 1-minute video such as: 

  • Cookies walls and the Dutch DPA - Ben Siegel discusses his research on the Dutch Personal Data Authorities' guidance on cookies walls and freely given consent. A cookie wall is a notice from the website, informing the user about the use of cookies on the website, without a reject option. Ben provides insight into the difference between functional cookies and tracking cookies and why the Dutch DPA's advises that websites’ basics functions are to remain available for everyone and not just for those that accept all cookies (including tracking cookies).   
Continue reading this post...

April 12, 2019

Protect Your Privacy Spring Cleaning

I’ll be honest, my blog idea was generated from an article about spring cleaning.  Let’s face it, lots of things could benefit from spring cleaning:  homes, cars, desk drawers… How about your inbox?  Maybe the ever-growing number of presentation drafts in your documents folder?  How about the flash drive in your desk drawer?  Anything in the cloud that’s been hanging out for years?  Maybe there’s a number of bookmarks or favorites on your list that hasn’t been used or accessed in a while.

Continue reading this post...

Other Recent Posts