Systems and Security : Governance, Risk, and Compliance

Roles and responsibilities refer to the different positions in an organization that are responsible for different aspects of data protection.

1. Data owners: They are the individuals or groups who own and control the data within an organization. They are responsible for defining the security and privacy policies for their data and ensuring that the data is handled appropriately.

2. Data controller: The data controller is responsible for determining the purposes and means of processing personal data. They are accountable for ensuring that the processing of personal data complies with data protection laws and regulations.

3. Data processor: The data processor is responsible for processing personal data on behalf of the data controller. They must act only on instructions from the data controller and must ensure that the processing of personal data is secure and complies with data protection laws and regulations.

4. Data custodian/steward: The data custodian is responsible for the physical storage and protection of the data. They must ensure that the data is stored securely and that only authorized personnel have access to it.

5. Data protection officer (DPO): The DPO is responsible for overseeing data protection within an organization and ensuring that the organization complies with data protection laws and regulations. They are also responsible for providing advice and guidance on data protection issues and training staff on data protection policies and procedures.

Information life cycle

The information life cycle is the process by which information is created, used, managed, and ultimately disposed of within an organization. It covers all stages of the information life cycle, from the collection and creation of data to its storage, processing, and dissemination, and finally, to its archiving, deletion or destruction.

Impact assessment

An impact assessment is a process used to evaluate the potential consequences of a particular action, decision, or event on an organization and its stakeholders. In the context of privacy and data protection, an impact assessment helps organizations identify and assess the potential privacy risks associated with their data processing activities, and take steps to mitigate these risks.

Terms of agreement

Terms of agreement refer to the legally binding agreement between two parties that outlines the terms and conditions of a particular transaction or relationship. In the context of privacy and data protection, terms of agreement typically outline the responsibilities of each party with respect to data protection and privacy, including the obligations of the data controller and the data processor.

Privacy notice

A privacy notice is a document or statement that provides information to individuals about the collection, use, and processing of their personal data. Privacy notices are typically provided to individuals at the time their data is collected, and they outline the purposes for which the data will be used, the types of data collected, the length of time it will be retained, and the rights of individuals with respect to their data.