HelpSource We invite you to send your information systems audit, control and security
Fax to: + 1.847.253.1443
Or mail to:
3701 Algonquin Road, Suite 1010
Rolling Meadows, IL 60008 USA
Privacy is one area that has never been
audited in my enterprise. Please provide
your point of view on how privacy compliance
can be assessed?
Though some standard security controls
can ensure protection of sensitive
information, including those that can be deemed
as private, security and privacy are not
synonymous. Privacy requirements
vary from country to country,
depending on national and regional
laws and regulations. However, there
are some common principles on
privacy based on which such laws/
regulations are created. Examples of
such principles include, but are not limited to,
• Purpose specification
• Collection limitation
• Access and rectification
• Disclosure to third parties
Depending on the country/continent, there are
multiple data protection models such as:
• Comprehensive laws of the European Union
• Sector-specific laws in the US
• Co-regulatory model, found in Australia
• Self-regulatory model, found in US, Japan
Compliance with regulations is mandatory and
This is an indicative list to outline the
assessment approach; only a lawyer can provide
(assuming one exists) must serve as the basis of
for its comprehensiveness. Operationalizing such
principles is essential so that the policy is adopted
both in letter and in spirit:
• Adequate notice must be provided to the
consumers whose data get collected.
• The notice given must explicitly state how the
information collected will be processed.
• Choice must be provided to the consumers.
In other words, does the enterprise provide for
the consumers to either opt in or
• The purpose for which data are
collected must be disclosed to
the consumers at the point of
collection. Any change in purpose
must also be disclosed.
• The data collected must not be
unlimited information. It must
be clearly predefined, limited
• Personal information (PI) collected must be
protected against threats such as unauthorized
access, modification impacting the integrity of
the data and deletion.
• Consent must be obtained from the data
subjects or the consumers from whom the data
• Consumers whose data are collected must be
given the facility to view the information held
about them. In addition, they must be given the
facility to amend or delete information that is
not complete, relevant or accurate.
• An identified individual must be designated to
be accountable for ensuring compliance toward
the above principles.
• What constitutes a breach must be clearly
identified. Processes and controls to handle any
breach must be defined and must be in place.
In some cases, notification has to be done
to external regulators and the data subjects/
consumers whose data have been compromised.
Disclosure as stipulated by laws and regulations
will not constitute a breach.
is director, information
security, at Flipkart, an online
marketplace entity. Previously,
he worked with Microsoft
India and Accenture, as well
Ernst & Young and a UK-based
mortgage institution while
living in the UK. Subramaniam
is an international conference
speaker and columnist.
Do you have
to say about
Visit the Journal
pages of the ISACA
web site ( www.isaca.
org/journal), find the
article, and choose
the Comments tab to
share your thoughts.
Go directly to the article:
“Security and privacy are not synonymous.