Privacy Operations, Training, and Auditing
What this domain tests
Privacy operations, training, and auditing test whether privacy controls run reliably day to day: DSAR workflows, records, training, monitoring, audits, and remediation.
Core rules and concepts
- Operations: documented procedures for intake, triage, verification, fulfillment, and closure of privacy requests; a request tracker; and SLA reporting.
- Records: retain evidence of notices, consents, assessments, vendor reviews, training, and incidents. Evidence should be dated and versioned.
- Training: role-based and risk-based. General awareness for all staff; deeper training for engineering, marketing, HR, and support. Track completion, test comprehension, and refresh on change.
- Auditing: define scope, criteria, sampling, interviews, and testing. Distinguish internal audit from monitoring. Report findings to governance and track remediation to closure.
- Metrics: DSAR cycle time, consent capture rates, assessment completion, training completion, vendor review coverage, audit findings aging.
Worked example
An internal audit finds 40% of marketing vendors lack current DPAs. The team prioritizes vendors with personal data, pauses onboarding for high-risk ones, updates procurement gates, and re-audits in 90 days. The metric is not “training delivered” but “high-risk vendors under contract.”
Traps that cost marks
- One-size-fits-all annual training that does not change behavior.
- Auditing without owners, deadlines, or verification of remediation.
- Keeping policies current but not procedures or system configurations.
- Measuring activity instead of control effectiveness.