Module 5

Data Security and Technology

Section 18 CDPA
• “(1) In order to safeguard the security, integrity and
confidentiality of the data, the controller or his or her
representative, if any, or the processor, shall take the
appropriate technical and organisational measures that are
necessary to protect data from negligent or unauthorised
destruction, negligent loss, unauthorised alteration or access
and any other unauthorised processing of the data.”
• “(2) These measures referred to in subsection (1) must ensure
an appropriate level of security taking into account the state
of technological development and the cost of implementing
the measures on the one hand, and the nature of the data to
be protected and the potential risks to the data subject on the
other hand.”
• 3) The Authority may issue appropriate standards relating to
information security for all or certain categories of processing
• (4) The data controller shall appoint a data processor who
shall provide sufficient guarantees regarding the technical and
organisational security measures employed to protect the
data associated with the processing undertaken and ensure
strict adherence to such measures.
• (5) The data controller shall enter into a written contract or any
other legal instrument with the data processor which ensures
that the data processor maintains security measures on data.
States of Data
The PII that a controller/processor processes exists in any of three forms. To exercise due care
diligence personal data has to be protected in all states .It is also important to note that different
security controls need be applied for different states of data.

Data at rest refers to data that is stored on a system and not actively being written to, read from,
transmitted, or otherwise processed. The data is “at rest” because there is no active processing or
transfer from device to device or across networks. Controls to protect data at rest include ,access
control including multifactor authentication, encryption and backups

Data in transit/Motion refers to data that is actively being transmitted across a network, between
multiple networks, or from one location to another. VPNs and network based DLP (data loss
prevention) systems are key control measure u can use to protect data In motion .

Data in use refers to data that is actively being processed by an application being used by a user
(either human or system). Host-based (or endpoint-based) Data Loss Prevention system can be used
to protect data in use in addition to other compensatory control measures.
Data Lifecycle
PRINCIPLES OF
DATA SECURITY

•CIA TRIAD
Confidentiality

Confidentiality is the concept of limiting access to data to authorized users

and systems and restricting access from unauthorized parties.

confidentiality guarantees that only intended people are able to access

information and resources, to prevent unauthorized access to data, as it
pertains to viewing, copying, or moving the data.

security controls available to assist with this include Encryption,

multifactor authentication, and role-based access controls .
Examples
o Encryption: Converting data into an unreadable format to protect
its confidentiality during storage and transmission.
o Access Control Lists (ACLs): Defining who can access specific data
or resources.
o Data Masking: Obscuring sensitive data while allowing for
legitimate use (e.g., for testing or development).
o Need-to-Know Basis: Granting access to data only to those
individuals who require it to perform their job duties.
Integrity

Integrity refers to the concept of safeguarding data accuracy and

reliability. Integrity protection makes sure that no unauthorised changes
have been made to the data.

It guarantees the accuracy, integrity, and preservation of data. Integrity

that is properly implemented allows for authorised changes while guarding
against harmful and intentional unauthorised activity (like viruses and
intrusions) as well as errors committed by authorised users (such
oversights or blunders).
Examples
o Hashing Algorithms: Generating a unique "fingerprint" of data to
detect any changes.
o Version Control: Tracking changes to data and allowing for rollback to
previous versions.
o Access Controls (Write Permissions): Restricting who can modify data.
o Data Validation: Ensuring data conforms to defined rules and formats
to maintain consistency and accuracy.
o Audit Trails: Logging all changes made to data to track modifications
and identify potential breaches.
 Availability

The term "availability" describes

something's timely and ongoing
accessibility to authorised
individuals. To put it another way,
it's ensuring that data is
accessible to authorised users in
the required form, at the suitable
time and place, and in the proper
format.
Examples
o Redundancy: Having backup systems, data storage, and network connections to
ensure continued operation in case of failures.
o Disaster Recovery and Business Continuity Planning: Processes and procedures to
restore data and systems after disruptions.
o Load Balancing: Distributing workload across multiple systems to prevent overload
and ensure performance.
o Denial of Service (DoS) Protection: Implementing measures to mitigate and prevent
attacks that aim to disrupt service availability.
o Regular Maintenance and Updates: Ensuring systems are properly maintained and
patched to prevent vulnerabilities that could lead to downtime.
 Non repudiation

Nonrepudiation guarantees that the person(s) involved in an activity or the one

who started it cannot dispute that it happened.

A subject cannot assert that they did not send a message, carry out an action, or
initiate an event if they have not repudiated their actions. Identification,
authentication, authorization, accountability, and auditing make it feasible.

Digital certificates, session identifiers, transaction logs, and a host of other

transactional and access control techniques can all be used to prove
nonrepudiation.
 Authentication

The controller has to employ

authentication to make sure that only
authorised individuals, services, and
applications have access to
organisational resources. It's a crucial
component of cyber security as gaining
unauthorised access to systems is a bad
actor's top aim. By taking the usernames
and passwords of users who do have
access, they are able to accomplish this.
There are three main steps in the
authentication process that is
identification, authentication and
authorisation.
Authentication Examples

o Passwords and Passphrases: Traditional method of authentication.

o Multi-Factor Authentication (MFA): Using multiple methods to verify
identity (e.g., password + SMS code, fingerprint).
o Biometrics: Using biological characteristics (fingerprint, facial
recognition) for authentication.
o Digital Certificates: Electronic documents used to verify the identity of
websites or applications.
Authentication Examples

o Audit Logging: Maintaining detailed records of system and user

activities.
o Digital Signatures: Cryptographic signatures used to verify the sender of
a message and ensure non-repudiation.
o User Identification: Uniquely identifying each user to track their actions.
 Due Diligence
Due diligence is legal concept that relates to continually ensuring that behaviour maintains due care. In
other words, due diligence is the ongoing execution and monitoring of due care. Due diligence is
establishing a plan, policy, and process to protect the confidentiality, integrity and security of PII.

Due diligence is developing a formalized security structure containing a security policy(Acceptable use
policy, Access control policy, Change management policy, Remote access policy, Disaster recover
policy, BYOD policy) standards, baselines, guidelines, and procedures .

Due diligence is knowing what should be done and planning for it;

With the enactment of the CDPA, prudence is mandatory. Showing due diligence and due care is the
only way to disprove negligence in an occurrence of a data breach.
 Due care

Due care relates to the

Due care is a legal term conduct that a reasonable
In data protection, due care
used to describe the person would exercise to
is using reasonable care to
conduct that a reasonable maintain the confidentiality,
protect the interests of the
person would exercise in a integrity, and availability of
data subject.
given situation. the personally identifiable
information under their care

a person’s actions can be Examples of due care in

assumed “reasonable” if a security are activities like
Exercising due care is
person of similar scanning and patching
intended to protect a
background and security vulnerabilities
controller his/her
experience, confronted with enabling security logging,
representative from
the same situation would and writing restrictive
accusations of negligence.
enact the same or similar firewall rules that enforce
actions least privilege
 • Implementing control measures demonstrates
that a controller, his or her representative, if
Key data any, or a processor, has taken due care and
due diligence in safeguarding the personal
privacy data they have collected.
controls
• The next slides look at some of the controls
that a controller cam implement to protect the
confidentiality ,integrity and security of data
Security Controls
• Technical controls are those that use automation and computer capabilities to implement
security safeguards. The technology safeguards protect sensitive data from abuse or illegal
access. In the majority of organisations, a variety of technical controls must cooperate in order to
safeguard against, identify, and address possible and real security problems and events.
• Administrative Controls include policies, processes, standards, and guidelines that an
organisation uses to apply technological and physical controls are known as administrative
controls. They are directed towards the general public. Organisational directives, industry best
practices, and rules and regulations are some of the possible sources of administrative controls.
• Physical controls are still very vital as information and technology assets continue to digitise and
become more networked. Restricting physical access to information assets is frequently the most
economical and successful preventive measure we can employ. A layered security strategy can
be achieved by creating asset protection programmes with guards and receptionists, entry
access controls, area illumination and monitoring, closed-circuit television (CCTV), and physical
intrusion detection systems.
Applicable Security Controls
• Preventive controls - These are the first-line controls that are designed to keep adverse security
events from occurring. For example, software applications typically have some form of “input
validation” to avoid invalid inputs from being executed and causing an issue. Firewalls, system
backups, and security awareness training are other common examples of preventative controls.
• Detective Controls : These controls are designed to identify a negative security event while it is in
progress or soon after it occurs. Much like a human detective, this type of control is intended to
gather information and help security teams determine what happened, how bad the damage is,
and what caused it to happen. Security audits, door alarms, and IDSs are common examples of
detective controls.
• Corrective controls : These controls are designed to minimize and repair damages following an
adverse security event; they are typically put in place after a detective control identifies a
problem. Corrective controls include things such as software patches, configuration file
modifications, and new policies that target the cause of the incident.
• Recovery: These countermeasures are designed to complement corrective controls, with the
intent to get a system back to normal as quickly as possible. Examples include system and data
backups and disaster recovery sites.
• Deterrent: These controls are designed to discourage attackers by making them think twice
about their malicious intents. Wired fences, security guards, and guard dogs are some examples
of deterrents.
 Data Privacy by design/
Privacy by Default
Privacy by Design means nothing more than “data protection through
technology design.” Behind this is the thought that data protection in data
processing procedures is best adhered to when it is already integrated in the
technology when created.
Privacy by Design involves building privacy directly into the design,
operation, and management of a system or process, rather than considering
privacy after the fact.
The seven Privacy by Design principles aim to ensure privacy of personal
data while also giving users more control over their personal information and
they are mentioned below
1. Proactive not Reactive; Preventative not Remedial
2. Privacy as the Default Setting
3. Privacy Embedded into Design
4. Full Functionality —Positive-Sum, not Zero-Sum
5. End-to-End Security —Full Lifecycle Protection
6. Visibility and Transparency —Keep it Open
7. Respect for User Privacy —Keep it User-Centric:
 Privacy by Design principles
Proactive not Reactive; Preventative not Remedial: Emphasizes designing systems that anticipate privacy
risks and address them before they occur, rather than
responding to breaches after they happen.

Privacy as the Default Setting: Ensures that personal data is automatically protected unless the user opts
for more permissive settings.

Privacy Embedded into Design: Integrates privacy features directly into the development process of
products and services, making it a fundamental component rather than
an add-on.

Full Functionality—Positive-Sum, not Zero-Sum: Promotes that privacy and user functionality can coexist,
enhancing both without compromising one for the other.

End-to-End Security—Full Lifecycle Protection: Advocates for comprehensive security measures that
protect data throughout its entire lifecycle, from collection
to deletion.
 Privacy by Design principles …..

Visibility and Transparency—Keep it Open: Encourages organizations to be transparent about their

data practices, allowing users to understand how their data
is used and protected.

Respect for User Privacy—Keep it User-Centric: Focuses on prioritizing user privacy and giving individuals
control over their personal information.
Data Privacy by Design Examples in Practice:
o Designing systems to minimize data collection: Only collecting the personal data that
is strictly necessary for a specific purpose.
o Implementing strong encryption and anonymization techniques from the outset:
Protecting data at rest and in transit right from the initial design phase.
o Developing robust access controls as a core system feature: Ensuring only authorized
personnel can access specific data based on their roles, built directly into the system
architecture.
o Conducting Privacy Impact Assessments (PIAs) during the design phase: Proactively
identifying and mitigating potential privacy risks before a system or process is
implemented.
o Creating user interfaces that clearly present privacy options and controls: Making
privacy settings easy to find and understand during the design of applications and
websites.
Privacy by Default Examples in Practice:
o Default privacy settings in social media profiles: Defaulting to "friends only" visibility for posts
rather than "public."
o Defaulting to "do not track" in web browsers: Requiring websites to respect user preferences
against tracking by default.
o Setting short data retention periods as default: Automatically deleting personal data after a
limited period once the purpose for processing is fulfilled, unless explicitly extended by the user.
o Offering users the option to "opt-in" to data collection for marketing purposes: Instead of pre-
ticked boxes for marketing consent, users must actively tick the box to give their consent.
o Setting default location services to "off" or "only while using app": Requiring users to explicitly
enable "always on" location tracking if desired.
 Least Priviledge and Need to know

• Least privilege describes access controls designed to give users the absolute
least amount of access needed to perform their job function, sometimes also
known as minimum necessary access.
• This access should be sufficient to perform assigned job functions and not in
excess of that requirement; for example, a data entry specialist likely does not
need administrative privileges to achieve their job function.
• Need-to-know is a concept describing a user’s organization-defined
requirement to access specific information, such as a personal data
contained in a system.
• If users with different need-to-know requirements will use the same system,
that system must implement the ability to restrict access on a granular level.
Endpoint Security- AVs

Endpoints include the laptops, desktops, and servers we’re all very
familiar with, but also include mobile devices, IoT devices, industrial
control systems, autonomous mobile systems, robots, and more.

Endpoint detection and response (EDR) is an emerging category of

security solutions that addresses the need for continuous monitoring
and response to advanced threats on all types of endpoints.

EDR works by continuously monitoring endpoint and network events

and analysing those events to detect, investigate, and respond to
suspicious activities
 Privacy Enhancing Technologies

• Privacy-enhancing technologies (PETs) are technologies, tools, techniques,

and practices designed to protect individuals' privacy. They achieve this by
safeguarding personal data during storage, processing, and transmission.
• PETs include methods like encryption, anonymization, access controls, and
solutions such as differential privacy, synthetic data generation, and
confidential computing. They help organizations and individuals maintain
control over their data and mitigate privacy risks in an increasingly data-centric
world.
• Examples of PETs are listed in the next slide
 PETs

• Synthetic data allows organizations to generate artificial data that closely mimics real-world
data, while still preserving privacy.
• Differential privacy is a mathematical method used in data analysis. It works by introducing
randomness or noise into query responses, making it harder to pinpoint individual data points.
• Homomorphic encryption enables computations on encrypted data without decrypting it first.
This ensures data privacy while still allowing meaningful operations to be carried out on the
encrypted information.
• Federated learning is a decentralized machine learning approach. Here, a model is trained
across multiple decentralized devices or servers holding local data samples, without exchanging
them. Instead of sending raw data to a central server, only model updates (gradients) are
communicated, preserving data privacy.
• Trusted execution environments are secure hardware or software environments within a
computer system. They provide a secure and isolated area for executing sensitive code or
operations.
 Pseudonymisation

Pseudonymisation is the processing

of personal data in such a manner
that the personal data can no longer
be attributed to a specific data
subject without the use of
additional information, provided
that such additional information is
kept separately and is subject to
technical and organizational
measures to ensure that the
personal data are not attributed to
an identified or identifiable natural
person.
Network Segmentation

Segmenting or isolating different parts of a network segmentation can limit the damage
network with access controls like firewalls of a security breach in one part of the
is a security best practice that may create network
 Data encryption seeks to meet four fundamental goals:
confidentiality, integrity, authentication, and
nonrepudiation. Before a message is put into a coded
form, it is known as a plaintext message and is
represented by the letter P when encryption functions are
Data described. The sender of a message uses a cryptographic
algorithm to encrypt the plaintext message and produce a
encryption ciphertext message, represented by the letter C. This
message is transmitted by some physical or electronic
means to the recipient. The recipient then uses a
predetermined algorithm to decrypt the ciphertext
message and retrieve the plaintext version. All
cryptographic algorithms rely on keys to maintain their
security
User and Entity Behavior
Analytics(UEBA/UBA)
• Entities are nonhuman actors on a network including
hardware like routers and servers and software processes,
threads, or daemons. Users are human users who log into
and interact with information systems. UEBA combines
machine learning and statistical analysis models to analyze
and define a baseline of normal or expected behavior by
users and entities interacting with information systems. Any
activity that deviates from this anticipated baseline is
flagged as suspicious and can be used as an input to other
security tools.
• Consider Tanyaradzwa, who logs into her workstation each
day around 10 a.m. and typically downloads between 10–
100 MB of data each day from the internal finance system.
Next Monday, Tanyaradzwa’s workstation begins
downloading hundreds of gigabytes of data from highly
sensitive systems that belong to the legal department and
the research and development department, and it sends
gigabytes of data to an external IP address. This is obviously
a suspicious situation, but one that traditional security
tools might miss due to a lack of targeted monitoring
focused on Alice and her workstation.
Zero trust model
• Zero trust - Zero trust is a security model that is predicated on the
idea that an organization should not automatically trust anything
outside or inside its perimeters—instead, they must verify anything and
everything trying to connect to its systems before allowing access. This
model is a drastic departure from the “trust, but verify” model that
involves fiercely defending your perimeters while assuming anything
inside your network is safe. The zero trust model preaches a “never
trust, always verify” mindset that requires every access request to be
fully authenticated, authorized, and encrypted before granting access.
–
• The zero trust model is based on the following core principles:
1. Always verify. Authenticate and authorize every access request
based on user identity, location, system health (e.g., patch levels),
data classification, user behavior analytics, and any other available
data points.
2. Least Privilege Access. Always assign the minimum rights required
for the specific access requested, on a Just in Time (JIT) basis.
3. Assume breach. Instead of trusting devices on your network,
assume the worst-case scenario (i.e., that you’ve already been
breached) and minimize the blast radius to prevent further damage.
 Data Classification

• The main method for protecting data

according to its need for sensitivity,
confidentiality, or secrecy is classification.
When creating and implementing a security
system, it is inefficient to approach all data
equally because some data pieces require
more security than others.
• Formalising and stratifying the process of
data security based on assigned labels of
relevance and sensitivity is the main goal of
data classification methods.
• The CDPA categorises data into two, that is
sensitive data and non-sensitive data.
Security Control Assessments
Periodic assessment of your security controls is equally as important as the selection and
implementation of those controls

The DPO should routinely conduct control assessments to ensure that your security and
privacy controls remain effective. SCAs may take the form of self-assessments or external
assessments conducted by third parties. There are many different SCA methodologies,
but they generally include some form of the following assessment methods: examine,
interview, and test

NIST 800-53A, “Assessing Security and Privacy Controls in Federal Information Systems
and Organizations,” lays out some helpful guidelines for conducting controls
assessments. Other Frameworks u can refer to include Nist RMF,COBIT ,RiskIT
Organisational Measures
Organisational security measures are a collection of steps that a company takes to protect
the availability, confidentiality, and/or integrity of data it processes. These include
operations, methods, systems, controls, and safeguards that are intended to promote safe
data processing and storage, stop data breaches, and guarantee adherence to relevant data
protection duties.

The most common organisational measures include crafting policies,guidelines,SOPS and

security baselines that will set the tone for security implementation best practice .

An organisation can also adopt international standards like ISO 27001 , Nist SP 800:53, NIST
RMF,NIST CSF
Privacy Risk management

Risk management includes all the processes associated with identifying

threats and vulnerabilities and quantifying and addressing the risk associated
with those threats and vulnerabilities.

Risk management processes provide a structured method for making security

decisions such as which controls to implement in order to protect data from
negligent or unauthorised destruction, negligent loss, unauthorised alteration
or access and any other unauthorised processing of the data
Risk:Threat:Vulnerabilities:Assets
Risk is the potential for negative impact on the organization, its goals or objectives, or
its assets (including people, systems, and data) due to a threat exploiting a
vulnerability.

A Threat is a negative event that can lead to an undesired outcome, such as damage
to, or loss of, an asset. A threat is posed by a threat actor, which is a person or entity
that is capable of intentionally or accidentally compromising an asset’s security

A Vulnerability is a weakness or gap that exists within a system that may be exploited
(by a threat actor) to compromise an asset’s security or trigger a risk event.
Vulnerabilities are the things within our systems that we try to fortify and improve.

An Asset is anything of value, which may include people, property, and information.
The greatest asset the DPO protects is the personal information of data subjects.
 • A risk assessment is the set of activities
that involve identifying the threats and
vulnerabilities that exist and determining
the impact and likelihood of those threats
Risk exploiting the identified vulnerabilities.
assessment There are numerous risk frameworks that
provide guidance on conducting risk
assessments.
 Steps in a risk assessment
Risk Identification - identify your assets and determine the value of those assets; this includes identifying and
classifying your sensitive data, based on its sensitivity or value to your organization,then identify and describe
the vulnerabilities and threats that pose a risk to each of those assets.

Risk Analysis - Risk analysis should always begin with a vulnerability assessment and a threat analysis This
stage of risk assessment is focused on evaluating the likelihood of identified threats exploiting weaknesses
(i.e., vulnerabilities) in your environment and determining the impact to your assets if that happens

Risk Evaluation – Here you compare the results of your risk analysis to your organization’s established risk
profile or risk tolerance (i.e., how much risk your organization is willing to take on). In doing so, you are able to
determine the best course of action for each of your identified risks.

Risk Response/Treatment - Once you identify and assess your organization’s threats, vulnerabilities, and
risks, you must determine the best way to address each risk; this is known as risk treatment (or risk response).
There are four main categories of risk treatment, avoid, mitigate, transfer, and accept.
 Risk Treatment Methods
Risk avoidance involves eliminating an identified risk by stopping or removing the activity or technology that causes
the risk in the first place. Organizations use risk avoidance when a particular risk exceeds their acceptable risk
tolerance.

Risk mitigation (sometimes called risk reduction or risk modification) is a strategy that involves reducing the
likelihood of a threat being realized or lessening the impact that the realized threat would have on the organization.

Risk transference (also known as risk assignment) involves shifting the responsibility and potential loss associated
with a risk onto a third party. Insurance is the most common form of risk transference. Sign contracts with the other
enterprises involved.

Risk acceptance -unsurprisingly involves accepting the risk associated with a particular threat. Risk acceptance is
the way to go if avoiding, mitigating, or transferring the risk would cost more than the expected losses of the realized
threat. In theory, a risk should be accepted only if it is completely within an organization’s risk tolerance. In practice,
organizations are often forced to accept potentially painful risks associated with normal business operations.
 UNIT 4 :KEY DATA SECURITY FRAMEWORKS AND EMERGING
TECHNOLOGIES

LEARNING OUTCOMES UNDERSTANDING SECURITY RISK MANAGEMENT AND MATURITY ASSESSMENT AND
FRAMEWORKS AND GOVERNANCE CONTINUOUS
REGULATORY COMPLIANCE IMPROVEMENT
Introduction

A competent DPO will advise the controller to adopt an internationally recognised

security framework as an organisational measure to demonstrate compliance with
section 18 of the act . Whilst there are many frameworks that a controller can adopt ,
we have listed just a few for this course and these are discussed below.
ISO 27001:2022
ISO 27001, “Information security,
cybersecurity and privacy protection —
Information security management
systems — Requirements”.

This specifies the requirements for

establishing, implementing,
maintaining, and continually improving
an information security management
system(ISMS) within the context of the
organization.
ISO 27001 in a nutshell
• ISO 27001:2022 lists only 93 controls rather than ISO 27001:2013’s 114.
This is due to the large number of merged controls (56 into 24).
• These controls are grouped into 4 ‘themes’ rather than 14 clauses. They
are:
1. People (8 controls)
2. Organisational (37 controls)
3. Technological (34 controls)
4. Physical (14 controls)
ISO 27001

• An ISMS takes a systematic approach to securing the CIA (confidentiality, integrity and availability) of
corporate information assets. An ISO 27001 ISMS consists of Organisational, People, Physical and
Technological controls, selected on the basis of regular risk assessments.
• Its technology- and vendor-neutral approach makes it suitable for all organisations, whatever their size,
complexity, sector or location
• Conformity with ISO/IEC 27001 means that an organization or business has put in place a system to
manage risks related to the security of data owned or handled by the company, and that this system
respects all the best practices and principles enshrined in this International Standard.
• An information security management system implemented according to this standard is a tool for risk
management, cyber-resilience and operational excellence.
ISMS: How to
ISO 27002
ISO 27002 “Information security, cybersecurity and privacy
protection — Information security controls”

ISO/IEC 27002 is an international standard that provides

guidance for organizations looking to establish, implement,
and improve an Information Security Management System
(ISMS) focused on cybersecurity. While ISO/IEC 27001
outlines the requirements for an ISMS, ISO/IEC 27002 offers
best practices and control objectives related to key
cybersecurity aspects including access control,
cryptography, human resource security, and incident
response. The standard serves as a practical blueprint for
organizations aiming to effectively safeguard their
information assets against cyber threats. By following
ISO/IEC 27002 guidelines, companies can take a proactive
approach to cybersecurity risk management and protect
critical information from unauthorized access and loss.
The ISO/IEC 27701 - Extension to ISO/IEC 27001
and ISO/IEC 27002 for privacy information
management — Requirements and guidelines

ISO/IEC 27701 specifies requirements and

provides guidance for establishing, implementing,
maintaining and continually improving a Privacy
Information Management System (PIMS) in the
form of an extension to ISO/IEC 27001 and
ISO/IEC 27002 for privacy management within the
context of the organization. Implementing the ISO
27701 demonstrates compliance with most of the
provisions laid out in the CDPA.
 • The standard can be mapped to many of the requirements under
CDPA. Once mapped, the ISO/IEC 27701 operational controls are
implemented by a controller/processor.
• ISO/IEC 27701 applies to all organizations that are PII controllers
and/or processors that process the relevant information within an
ISMS.
• The standard encompasses various key requirements, including;

ISO/IEC 1.
2.
Conducting privacy risk assessments
Implementing privacy controls
27701:2019 3. Defining roles and responsibilities

overview 4.
5.
Ensuring consent management
Handling data subject rights
6. Establishing processes for incident response and breach
notification.
• ISO 27701 leverages the Annex A controls of ISO 27001 and
supplements them with additional controls specific to privacy
management. This integration streamlines the implementation
process, enabling organisations to establish a robust framework
covering information security and privacy requirements
Privacy Maturity Model (PMM)

• A privacy maturity model provides a framework for developing, implementing, maintaining, and evaluating privacy programs within
organizations.
• Maturity models are a recognized means by which organizations can measure their progress against established benchmarks. As such,
they recognize that:
1. becoming compliant is a journey and progress along the way strengthens the organization, whether or not the organization has
achieved all of the requirements;
2. in certain cases, such as security-focused maturity models, not every organization, or every security application, needs to be at the
maximum for the organization to achieve an acceptable level of security; and
3. creation of values or benefits may be possible if they achieve a higher maturity level.
• The AICPA/CICA PMM is based on Generally Accepted Privacy Principles (GAPP) to assist organizations in strengthening their privacy
policies, procedures and practices.
• GAPP has been developed to help management create an effective privacy program that addresses privacy risks and obligations as well
as business opportunities. It can also be a useful tool to boards and others charged with governance and the provision of oversight. It
includes a definition of privacy and an explanation of why privacy is a business issue and not solely a compliance issue
 Ad hoc – procedures or processes are generally informal,
incomplete and inconsistently applied.

The
Repeatable – procedures or processes exist; however, they are
not fully documented and do not cover all relevant aspects.

AICPA/CICA Defined – procedures and processes are fully documented

PMM‘s five and implemented and cover all relevant aspects.

maturity levels Managed – reviews are conducted to assess the effectiveness

of the controls in place.

Optimized – regular review and feedback are used to ensure

continuous improvement towards optimization of the given
process.
Thank you

Contacts - 0783642011 – Zivo K Chamba Email chamba@[Link]

chamba@[Link]

0774765791 – Monika Gondo mgondo@[Link]

mgondo@[Link]