Privacy Responsibilities (HRS-004-R004) - HRS-004

Requirement Details & Guidance

HRS-004-R004 · HRS-004

Why This Requirement Exists

This requirement exists to include privacy and personal-data protection responsibilities in the code of conduct, ensuring personnel security obligations are consistently defined, understood, applied, and evidenced.

Implementation Guidance

Establish and document the process to include privacy and personal-data protection responsibilities in the code of conduct. Define accountable roles, applicable personnel or roles, required inputs and outputs, authorization or validation criteria, timing or triggers, exception handling, evidence and retention requirements, monitoring, reporting, review, and escalation. Apply the process consistently and in accordance with applicable legal and organizational requirements.

Practical Application & Audit Readiness

HRS-004-R004 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

HRS-004 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.2 – Align, Plan and Organize (APO) > APO01 – Managed I&T Management Framework > APO01.05 – Establish roles and responsibilities. 4.2 – Align, Plan and Organize (APO) > APO07 – Managed Human Resources > APO07.04 – Assess and recognize/reward employee job performance.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 13(6) – ICT security awareness and digital operational resilience training	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 29 – Processing under the authority of the controller or processor; Article 32(4) – Personnel processing under authority	EU Regulation	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.4-3.2 – On-Boarding and During Employment	India Guideline	vLatest	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 5.3 – Organizational roles, responsibilities and authorities	ISO Standard	v2022	View →
ISO27701	ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: 6.3.2.1; 6.3.2.1 – Terms and conditions of employment (privacy)	ISO Privacy Standard	v2019	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(i) – Human resources security, access control policies and asset management	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.RR – Roles, Responsibilities, and Authorities \| GV.RR-04 – Cybersecurity is included in human resources practices PR.AT – Awareness and Training \| PR.AT-01 – Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind PR.AA – Identity Management, Authentication, and Access Control \| PR.AA-01 – Identities and credentials for authorized users, services, and hardware are managed by the organization	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.14 – PERSONNEL SECURITY; PS-9 – POSITION DESCRIPTIONS	NIST Control Catalog	vRev. 5	View →
NPCI-ISR	NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Governance and Oversight Structure – Roles and Responsibilities	India Standard	vLatest	View →
RBI-CSF	RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 23) User / Employee/ Management Awareness – 23.1 Security/acceptable-use policies communicated to users, employees, vendors and partners with cybersecurity education	India Regulation	vLatest	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.2 GV.RR: Roles, Responsibilities and Authorities; 3.2 PR.AT: Awareness and Training	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC1.1 – Control Environment – COSO Principle 1: The entity demonstrates a commitment to integrity and ethical values. CC1.5 – Control Environment – COSO Principle 5: The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives. CC1.3 – Control Environment – COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Human Resource Security (HRS)

Purpose:

To cultivate a security-conscious workforce and manage human-related risks.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Employee Code of Conduct & Ethics (HRS-004)

Summary:

Establishes code of conduct including ethical behavior, security responsibilities, privacy responsibilities, acceptable behavior, policy compliance, violation reporting, disciplinary process, periodic review, and continuous improvement.

Business Description:

Establish, communicate, and enforce a code of conduct defining expected standards of ethical behavior, information security, privacy, acceptable use, and regulatory compliance for all personnel.

View