Privacy Risk Assessment

The first step in a privacy best practices program is to identify risks. This is commonly termed a risk assessment. The risk assessment should cover identity theft, privacy, and information security. The Privacy Compliance Officer is the person who will either perform, or contract with a certified risk management specialist to conduct, the risk assessment.  You can begin assessing your business privacy and information security risks by reflecting on a few basic questions:

• What sensitive information does your business collect?
• How do you collect the information?
• Who has access to the information?
• How is the information used?
• Where is the information stored?
• When do you dispose of the information?
• How do you dispose of the information?
• Is the information shared with third parties?
• How is the information transmitted?

Answering these questions are the starting point to assessing your risks.  Make sure to include a risk assessment of your:

• Administrative Security
• Physical Security, and
• Cyber Security.

---

Add this page to your favorite Social Bookmarking websites