Form banner image

Please answer these simple 10 questions.


This survey will help determine if your security and governance would improve with YouAttest.

Systems/products/services that process data are inventoried. Owners or operators (e.g., the organization or third parties such as service providers, partners, customers, and developers) and their roles with respect to the systems/products/services and components (e.g., internal or external) that process data are inventoried. Data actions of the systems/products/services are inventoried. Data elements within the data actions are inventoried.
Contextual factors related to the systems/products/services and the data actions are identified (e.g., individuals’ demographics and privacy interests or perceptions, data sensitivity and/or types, visibility of data processing to individuals and third parties). Data analytic inputs and outputs are identified and evaluated for bias. Potential problematic data actions and associated problems are identified. Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Data processing ecosystem risk management policies, processes, and procedures are identified, established, assessed, managed, and agreed to by organizational stakeholders. Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process. Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated. Roles and responsibilities for the workforce are established with respect to privacy. Privacy roles and responsibilities are coordinated and aligned with third-party stakeholders (e.g., service providers, customers, partners).
Risk management processes are established, managed, and agreed to by organizational stakeholders. Organizational risk tolerance is determined and clearly expressed. The organization’s determination of risk tolerance is informed by its role(s) in the data processing ecosystem.
The workforce is informed and trained on its roles and responsibilities. Senior executives understand their roles and responsibilities. Privacy personnel understand their roles and responsibilities. Third parties (e.g., service providers, customers, partners) understand their roles and responsibilities.
Privacy risk is re-evaluated on an ongoing basis and as key factors, including the organization’s business environment (e.g., introduction of new technologies), governance (e.g., legal obligations, risk tolerance), data processing, and systems/products/services change. Privacy values, policies, and training are reviewed and any updates are communicated. Policies, processes, and procedures incorporate lessons learned from problematic data actions.
Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place. Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place. A data life cycle to manage data is aligned and implemented with the system development life cycle to manage systems.
Data elements can be accessed for review. Data elements can be accessed for alteration. Data elements can be accessed for deletion. Data are destroyed according to policy. Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
Transparency policies, processes, and procedures for communicating data processing purposes, practices, and associated privacy risks are established and in place. Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place. Mechanisms for obtaining feedback from individuals (e.g., surveys or focus groups) about data processing and associated privacy risks are established and in place.