Data Governance and Privacy Program Management
What this domain tests
Privacy program management tests how you build accountability: governance, roles, data inventory, policies, privacy by design, and metrics that make privacy operational rather than aspirational.
Core rules and concepts
- Governance: assign a privacy lead with authority, a steering committee, and RACI clarity among legal, security, product, marketing, HR, and procurement.
- Data inventory and records of processing: capture categories of data, purposes, systems, owners, retention, recipients, and cross-border flows. This is the foundation for DSARs, DPIAs, and breach scoping.
- Policies and standards: notice, retention, acceptable use, vendor risk, incident response, and data classification. Policies must match practice.
- Privacy by design: embed controls in the SDLC-requirements, design review, testing, launch gates, and post-launch monitoring.
- Frameworks: NIST Privacy Framework (Identify-P, Govern-P, Control-P, Communicate-P, Protect-P) can structure controls; it is not a certification.
- Metrics: request volume and cycle time, training completion, assessment coverage, vendor reviews, incident trends.
Worked example
Marketing wants a new analytics SDK that captures device IDs and location. The privacy office checks the inventory, finds no approved purpose for precise location, and requires: notice update, consent where required, retention cap, vendor DPA, and a DPIA. Launch is gated on evidence.
Traps that cost marks
- Treating privacy as legal review only; product and engineering must own controls.
- Building a policy set without a data inventory, making DSARs and breach scoping slow.
- Letting the DPO title exist without independence, budget, or escalation access.
- Using metrics that measure activity (meetings held) rather than outcomes (request cycle time).