Data Management, Privacy and Emerging Technology
Domain 8 tests data governance, privacy obligations and the assurance approach for newer technology, where the auditor often has less direct visibility and more dependence on third parties.
Data governance and quality
- Assign ownership and stewardship, classify data (public, internal, confidential, restricted), set retention and destruction schedules, and operate data loss prevention.
- Quality dimensions: completeness, accuracy, timeliness, consistency, uniqueness, validity. Test the dimension the business process actually depends on.
- Lifecycle: create, store, use, share, archive, destroy, with evidence of secure destruction rather than a policy statement.
Privacy
- A controller determines purpose and means; a processor acts on documented instructions. Audit the party carrying the obligation, and read the contract when the two differ.
- Core principles: lawful basis, purpose limitation, minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.
- GDPR items that appear in questions: DPO appointment, DPIA for high-risk processing, 72-hour breach notification to the regulator, data subject rights, and transfer mechanisms such as adequacy decisions or standard contractual clauses.
- Privacy by design and by default. Pseudonymisation reduces risk but is not anonymisation.
Emerging technology
- Cloud: shared responsibility model, due diligence on SOC 2 or ISO/IEC 27001 reports, data residency, sub-processor listing, key custody (BYOK/HYOK), exit and deletion terms.
- AI: model inventory and governance, training data provenance and rights, bias and performance testing, human oversight, explainability, logging, and alignment with the NIST AI Risk Management Framework or ISO/IEC 42001.
- RPA: bot identities and credentials, bot change control, segregation between bot builder and bot operator.
- Blockchain: immutability supports integrity but does nothing for confidentiality or input accuracy.
Worked example
An HR SaaS platform processes EU employee data. Review the data processing agreement, sub-processor list, transfer mechanism, breach notification terms against the 72-hour obligation, retention and deletion on exit, and the provider's SOC 2 Type 2 including complementary user entity controls. The provider's certificate alone does not evidence that this organisation configured the service correctly.
Traps
- Calling a processor a controller, or the reverse.
- Treating encryption as anonymisation.
- Limiting cloud assurance to the provider's certification.
- Auditing AI accuracy without asking who is accountable for model risk.