Question

A privacy officer at a mid-sized healthcare company is establishing a formal privacy program. The organization already maintains a mature information security program aligned to ISO 27001 and an established enterprise risk management (ERM) process. To operationalize the privacy program most efficiently while ensuring accountability and reducing duplication, what should the privacy officer do FIRST?

Accepted Answer

Assess how existing security and ERM structures can be leveraged and integrated to support privacy program objectives

Answer

Build a standalone privacy program with independent governance, controls, and risk processes to keep privacy fully separate from security

Answer

Purchase a privacy management tool and configure it to automate records of processing and consent tracking

Answer

Draft comprehensive privacy policies covering all applicable regulations before evaluating current capabilities