Are privacy responsibilities reviewed when business processes change?

Documents and records that prove your maturity level.

• A Privacy Change Checklist or template used whenever a new system, process, or vendor is introduced
• A Change Management & Privacy Review Policy document (even a one-page policy is sufficient) that describes when and how privacy reviews are triggered
• A Privacy Review Log or spreadsheet showing date of change, description, reviewer name, privacy risks identified, and sign-off
• For each significant change: a Privacy Risk Assessment document or form that identifies what personal data is involved, who handles it, and what controls are in place
• Vendor contracts or Data Processing Agreements (DPAs) that include privacy and data security clauses, especially for vendors handling customer or employee data

Prepare for these questions from customers or third-party reviewers.

• "Walk me through the last three business process changes in your organization. For each one, show me evidence that a privacy review was performed before the change was implemented."
• "What is your process for identifying when a privacy review is needed? Do you have a policy or checklist that describes this?"
• "When was the last time you reviewed privacy responsibilities for a new vendor, system, or data type? What did you find, and how did you document the decision?"
• "If I pick a recent change from your change log, can you show me the privacy assessment, risk rating, and any mitigation steps that were taken?"