Establishes the processes for protecting personal and sensitive data throughout its lifecycle, ensuring privacy compliance and data security across all processing activities.
Encompasses data classification, handling, retention, and disposal. It also includes Data Loss Prevention (DLP), encryption, and managing Data Subject Access Requests (DSARs).
Organizations struggle to locate sensitive data across vast data landscapes, manage data subject rights at scale, and keep pace with evolving privacy regulations globally.
| Control ID | Control Name | Category & Type | Criticality | Status | Requirements | Action |
|---|---|---|---|---|---|---|
| DAT-001 | Data Protection & Privacy Strategy Establishes enterprise data protection a... |
Administrative
Preventive
|
Critical | Active | 📋 10 Reqs | View → |
| DAT-002 | Data Discovery Establishes automated and manual process... |
Technical
Detective
|
High | Active | 📋 10 Reqs | View → |
| DAT-003 | Data Classification & Handling Establishes a data classification framew... |
Administrative
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-004 | Data Retention & Disposal Establishes data retention schedules, ar... |
Technical
Preventive
|
Critical | Active | 📋 10 Reqs | View → |
| DAT-005 | Data Ownership & Stewardship Establishes clear data ownership and ste... |
Technical
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-006 | Data Flow Mapping, Inventory & Lineage Establishes comprehensive data flow mapp... |
Administrative
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-007 | Data Subject Rights Management Establishes processes for receiving, val... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| DAT-008 | Consent Management Establishes comprehensive consent manage... |
Administrative
Detective
|
High | Active | 📋 10 Reqs | View → |
| DAT-009 | Cross-Border Data Transfer Establishes governance for cross-border... |
Technical
Detective
|
High | Active | 📋 10 Reqs | View → |
| DAT-010 | Privacy Notices Establishes processes for developing, pu... |
Technical
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-011 | Privacy by Design Establishes processes to integrate priva... |
Technical
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-012 | Data Protection Impact Assessment (DPIA) Establishes formal DPIA processes for sc... |
Technical
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| DAT-013 | Record of Processing Activities (ROPA) Establishes and maintains a complete, ac... |
Technical
Preventive
|
High | Active | 📋 10 Reqs | View → |
| DAT-014 | Data Loss Prevention (DLP) Establishes Data Loss Prevention control... |
Technical
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| DAT-015 | Data Integrity Establishes data integrity controls incl... |
Technical
Detective
|
Critical | Active | 📋 10 Reqs | View → |
| DAT-016 | Data Masking & Anonymization Establishes data masking and anonymizati... |
Technical
Detective
|
High | Active | 📋 10 Reqs | View → |
The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.
| REQUIREMENT ID | REQUIREMENT TITLE & DETAILS | MAPPED CONTROL | TYPICAL OWNER | ACTION |
|---|---|---|---|---|
| DAT-001-R001 | Data Protection & Privacy Framework The organization shall establish a data... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R002 | Strategic Objectives The organization shall define strategic... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R003 | Privacy Governance The organization shall establish privacy... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R004 | Data Protection Roles & Responsibilities The organization shall clearly define an... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R005 | Strategy Implementation The organization shall execute the data... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R006 | Privacy Risk Alignment The organization shall align data protec... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R007 | Strategy Communication The organization shall communicate the d... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R008 | Strategy Performance Monitoring The organization shall monitor the perfo... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R009 | Strategy Review The organization shall conduct periodic... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-001-R010 | Strategy Continuous Improvement The organization shall drive ongoing enh... | DAT-001 Data Protection & Privacy Stra... | Data Protection Officer, CISO, Privacy Governance Committee | View ↗ |
| DAT-002-R001 | Data Discovery Framework The organization shall establish a data... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R002 | Discovery Scope The organization shall define a document... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R003 | Data Discovery Configuration The organization shall configure data di... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R004 | Data Discovery Execution The organization shall execute data disc... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R005 | Sensitive Data Identification The organization shall use data discover... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R006 | Discovery Validation The organization shall validate data dis... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R007 | Discovery Monitoring The organization shall monitor data disc... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R008 | Discovery Reporting The organization shall report on data di... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R009 | Discovery Review The organization shall conduct periodic... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-002-R010 | Discovery Continuous Improvement The organization shall drive ongoing enh... | DAT-002 Data Discovery | Data Protection Officer, Data Governance Team, Data Owners | View ↗ |
| DAT-003-R001 | Data Classification Framework The organization shall establish a data... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R002 | Classification Criteria The organization shall define classifica... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R003 | Data Classification Assignment The organization shall assign classifica... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R004 | Data Labeling The organization shall label data with i... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R005 | Data Handling Requirements The organization shall define data handl... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R006 | Classification Review The organization shall conduct periodic... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R007 | Classification Change Management The organization shall manage changes to... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R008 | Classification Monitoring The organization shall monitor data clas... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R009 | Classification Reporting The organization shall report on data cl... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-003-R010 | Classification Continuous Improvement The organization shall drive ongoing enh... | DAT-003 Data Classification & Handling | Data Owners, Data Stewards, Data Protection Officer | View ↗ |
| DAT-004-R001 | Data Retention Framework The organization shall establish a data... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R002 | Retention Schedule Management The organization shall maintain retentio... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R003 | Data Archival The organization shall archive data that... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R004 | Data Disposal Authorization The organization shall authorize the dis... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R005 | Secure Data Destruction The organization shall securely destroy... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R006 | Disposal Verification The organization shall verify that data... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R007 | Retention Compliance Monitoring The organization shall monitor retention... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R008 | Retention Reporting The organization shall report on retenti... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R009 | Retention Review The organization shall conduct periodic... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-004-R010 | Retention Continuous Improvement The organization shall drive ongoing enh... | DAT-004 Data Retention & Disposal | Data Protection Officer, Records Management, Legal, Data Owners | View ↗ |
| DAT-005-R001 | Data Ownership Framework The organization shall establish a data... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R002 | Data Owner Assignment The organization shall assign explicit d... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R003 | Data Steward Responsibilities The organization shall define and assign... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R004 | Ownership Accountability The organization shall establish account... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R005 | Ownership Transfer The organization shall transfer data own... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R006 | Ownership Validation The organization shall validate data own... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R007 | Ownership Documentation The organization shall maintain comprehe... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R008 | Ownership Reporting The organization shall report on data ow... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R009 | Ownership Review The organization shall conduct periodic... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-005-R010 | Ownership Continuous Improvement The organization shall drive ongoing enh... | DAT-005 Data Ownership & Stewardship | Data Owners, Data Stewards, Data Governance Committee | View ↗ |
| DAT-006-R001 | Data Inventory Framework The organization shall establish a data... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R002 | Data Flow Identification The organization shall identify data flo... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R003 | Data Inventory Management The organization shall maintain a compre... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R004 | Data Flow Mapping The organization shall create and mainta... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R005 | Data Lineage Documentation The organization shall document data lin... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R006 | Data Flow Validation The organization shall validate data flo... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R007 | Data Flow Monitoring The organization shall monitor data flow... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R008 | Data Flow Reporting The organization shall report on data fl... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R009 | Data Flow Review The organization shall conduct periodic... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-006-R010 | Data Flow Continuous Improvement The organization shall drive ongoing enh... | DAT-006 Data Flow Mapping, Inventory &... | Data Owners, Data Stewards, Data Governance Team | View ↗ |
| DAT-007-R001 | Rights Management Framework The organization shall establish a data... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R002 | Request Intake The organization shall receive data subj... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R003 | Identity Verification The organization shall verify the identi... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R004 | Rights Request Processing The organization shall process data subj... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R005 | Response Management The organization shall respond to data s... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R006 | Request Tracking The organization shall track data subjec... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R007 | Regulatory Compliance Monitoring The organization shall monitor data subj... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R008 | Rights Reporting The organization shall report on data su... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R009 | Rights Review The organization shall conduct periodic... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-007-R010 | Rights Continuous Improvement The organization shall drive ongoing enh... | DAT-007 Data Subject Rights Management | Data Protection Officer, Privacy Operations, Legal | View ↗ |
| DAT-008-R001 | Consent Management Framework The organization shall establish a conse... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R002 | Consent Collection The organization shall collect consent f... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R003 | Consent Recording The organization shall record consent de... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R004 | Consent Validation The organization shall validate the vali... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R005 | Consent Withdrawal The organization shall process consent w... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R006 | Consent Lifecycle Management The organization shall manage the lifecy... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R007 | Consent Monitoring The organization shall monitor consent m... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R008 | Consent Reporting The organization shall report on consent... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R009 | Consent Review The organization shall conduct periodic... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-008-R010 | Consent Continuous Improvement The organization shall drive ongoing enh... | DAT-008 Consent Management | Data Protection Officer, Privacy Operations, Legal, Product Owners | View ↗ |
| DAT-009-R001 | Cross-Border Transfer Framework The organization shall establish a cross... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R002 | Transfer Assessment The organization shall assess cross-bord... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R003 | Transfer Authorization The organization shall authorize cross-b... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R004 | Transfer Safeguards The organization shall implement appropr... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R005 | Transfer Documentation The organization shall maintain comprehe... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R006 | Transfer Monitoring The organization shall monitor cross-bor... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R007 | Regulatory Compliance Verification The organization shall verify that cross... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R008 | Transfer Reporting The organization shall report on cross-b... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R009 | Transfer Review The organization shall conduct periodic... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-009-R010 | Transfer Continuous Improvement The organization shall drive ongoing enh... | DAT-009 Cross-Border Data Transfer | Data Protection Officer, Legal, Privacy Operations | View ↗ |
| DAT-010-R001 | Privacy Notice Framework The organization shall establish a priva... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R002 | Notice Content Management The organization shall develop and maint... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R003 | Notice Publication The organization shall publish privacy n... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R004 | Notice Accessibility The organization shall ensure privacy no... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R005 | Notice Updates The organization shall update privacy no... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R006 | Notice Communication The organization shall communicate priva... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R007 | Notice Compliance Monitoring The organization shall monitor privacy n... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R008 | Notice Reporting The organization shall report on privacy... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R009 | Notice Review The organization shall conduct periodic... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-010-R010 | Notice Continuous Improvement The organization shall drive ongoing enh... | DAT-010 Privacy Notices | Data Protection Officer, Legal, Communications, Product Owners | View ↗ |
| DAT-011-R001 | Privacy by Design Framework The organization shall establish a priva... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R002 | Privacy Requirements Identification The organization shall identify privacy... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R003 | Privacy Design Assessment The organization shall conduct privacy d... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R004 | Privacy Control Integration The organization shall integrate privacy... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R005 | Privacy Validation The organization shall validate that sys... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R006 | Design Change Management The organization shall manage changes to... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R007 | Privacy Compliance Monitoring The organization shall monitor privacy b... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R008 | Design Reporting The organization shall report on privacy... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R009 | Design Review The organization shall conduct periodic... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-011-R010 | Design Continuous Improvement The organization shall drive ongoing enh... | DAT-011 Privacy by Design | Data Protection Officer, Privacy Engineering, Application Owners | View ↗ |
| DAT-012-R001 | DPIA Framework The organization shall establish a Data... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R002 | DPIA Scoping The organization shall scope DPIAs, iden... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R003 | Privacy Risk Assessment The organization shall conduct privacy r... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R004 | Risk Treatment Planning The organization shall develop risk trea... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R005 | DPIA Approval The organization shall approve DPIAs and... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R006 | DPIA Documentation The organization shall maintain comprehe... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R007 | DPIA Monitoring The organization shall monitor DPIAs to... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R008 | DPIA Reporting The organization shall report on DPIAs,... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R009 | DPIA Review The organization shall conduct periodic... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-012-R010 | DPIA Continuous Improvement The organization shall drive ongoing enh... | DAT-012 Data Protection Impact Assessm... | Data Protection Officer, Privacy Risk, Legal, Business Owners | View ↗ |
| DAT-013-R001 | ROPA Framework The organization shall establish a Recor... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R002 | Processing Activity Identification The organization shall identify all proc... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R003 | Processing Record Maintenance The organization shall maintain comprehe... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R004 | Processing Activity Classification The organization shall establish classif... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R005 | Processing Record Validation The organization shall validate ROPA rec... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R006 | ROPA Maintenance The organization shall maintain ROPA rec... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R007 | ROPA Monitoring The organization shall monitor ROPA mana... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R008 | ROPA Reporting The organization shall report on ROPA, p... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R009 | ROPA Review The organization shall conduct periodic... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-013-R010 | ROPA Continuous Improvement The organization shall drive ongoing enh... | DAT-013 Record of Processing Activitie... | Data Protection Officer, Data Owners, Privacy Operations | View ↗ |
| DAT-014-R001 | Data Loss Prevention Framework The organization shall establish a Data... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R002 | DLP Policy Definition The organization shall define DLP polici... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R003 | Sensitive Data Monitoring The organization shall monitor sensitive... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R004 | Data Loss Prevention Controls The organization shall implement control... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R005 | DLP Incident Management The organization shall manage DLP incide... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R006 | DLP Exception Management The organization shall manage exceptions... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R007 | DLP Monitoring The organization shall monitor DLP activ... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R008 | DLP Reporting The organization shall report on DLP, pr... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R009 | DLP Review The organization shall conduct periodic... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-014-R010 | DLP Continuous Improvement The organization shall drive ongoing enh... | DAT-014 Data Loss Prevention (DLP) | CISO, DLP Team, SOC, Data Protection Officer | View ↗ |
| DAT-015-R001 | Data Integrity Framework The organization shall establish a data... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R002 | Integrity Protection Controls The organization shall implement control... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R003 | Data Validation The organization shall validate data int... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R004 | Integrity Monitoring The organization shall monitor data inte... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R005 | Integrity Verification The organization shall verify data integ... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R006 | Integrity Incident Management The organization shall manage data integ... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R007 | Integrity Assessment The organization shall conduct periodic... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R008 | Integrity Reporting The organization shall report on data in... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R009 | Integrity Review The organization shall conduct periodic... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-015-R010 | Integrity Continuous Improvement The organization shall drive ongoing enh... | DAT-015 Data Integrity | Data Owners, Data Stewards, IT Operations, CISO | View ↗ |
| DAT-016-R001 | Data Masking & Anonymization Framework The organization shall establish a data... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R002 | Sensitive Data Identification The organization shall identify sensitiv... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R003 | Masking Requirements The organization shall define masking re... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R004 | Anonymization & Pseudonymization The organization shall implement anonymi... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R005 | Data Transformation Validation The organization shall validate that dat... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R006 | Non-Production Data Protection The organization shall implement data ma... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R007 | Masking Effectiveness Monitoring The organization shall monitor masking a... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R008 | Masking Reporting The organization shall report on masking... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R009 | Masking Review The organization shall conduct periodic... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| DAT-016-R010 | Masking Continuous Improvement The organization shall drive ongoing enh... | DAT-016 Data Masking & Anonymization | Data Protection Officer, Data Engineering, Application Owners, Security Engineering | View ↗ |
| Framework Code | Framework Name & Description | Family / Category | Version | Action |
|---|---|---|---|---|
| GDPR | GDPR The General Data Protection Regulation i... |
EU
Regulation
|
vCurrent | View → |
| MAPPED | CCPA/CPRA Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | NIST Privacy Framework Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | ISO 27701 Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| COBIT2019 | COBIT (APO13) COBIT is an enterprise governance and ma... |
COBIT
Governance Framework
|
v2019 | View → |
| HIPAA | HIPAA HIPAA is a U.S. federal law supported by... |
US
Law
|
vCurrent | View → |
| MAPPED | GLBA Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | UK GDPR Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |
| MAPPED | DPDPA Crosswalk regulatory baseline mapped under ASPIA UCL. | Standard | Baseline | — |