175 practitioner articles on where governance programs look complete and are not, and what to do about it. From the author of the #DoNotBeLarry series.
Your privacy program was built for data you can locate, correct, and delete. AI systems do not work that way. The gap between these two realities is the most significant…
Every internal data flow in a mature enterprise has some form of governance: a data architecture record, an access control, a monitoring capability, a retention policy.
Vendor assurances are statements about what the vendor does. They appear in questionnaire responses, in sales presentations, in contract representations, and in certifica…
Vendor concentration risk is the risk that the organization's dependence on a small number of vendors for critical functions creates an exposure that the organization can…
The vendor completed the security questionnaire. Every question received a positive response. Multi-factor authentication: implemented. Encryption at rest: implemented.
The business continuity plan was comprehensive. It covered data center fires, network outages, hardware failures, and cyberattacks. It covered regional disasters with fai…
The acquisition closed on a Thursday. By the following Monday, the acquiring organization had inherited the acquired company's customer base, their revenue contracts, the…
Shadow IT is the technology adopted outside formal IT governance. Shadow procurement is the mechanism through which most shadow IT arrives: a business team identifies a t…
The contract specifies what the vendor is required to do. It defines data handling obligations, security standards, breach notification timelines, audit rights, and remed…
The annual vendor review is scheduled, conducted, documented, and closed. The vendor completes the updated questionnaire. The questionnaire is scored.
Procurement manages vendor relationships through the lens of commercial risk: price, delivery, contract terms, supplier financial stability, and performance against servi…
The argument for continuous vendor monitoring used to be a preference. Organizations with mature TPRM programs invested in ongoing monitoring because it was better practi…
The threat model covered the obvious vectors. Direct attacks on internet-facing systems. Phishing campaigns targeting employees. Credential theft and lateral movement.
This is not a rhetorical question. It is a governance question that most organizations cannot answer completely, and the completeness of the answer is a direct indicator…
Ask the general counsel of a GDPR-subject organization whether their cross-border data transfers are compliant. The answer is yes. Ask them which systems send personal da…
Behavioral advertising is the practice of targeting advertising to individuals based on their observed behavior — the websites they visit, the content they engage with, t…
Last sprint, the product team shipped four features. One extended the data collected from users in the onboarding flow, adding three new fields that the product manager d…
Biometric data enters enterprise systems through more pathways than most privacy programs have mapped. Building access systems that use fingerprint or facial recognition.
Under GDPR Article 33, the 72-hour notification clock starts when the controller becomes aware of the breach. Awareness, in regulatory guidance and enforcement practice,…
Employee data is the most consistently underestimated category of personal data in enterprise privacy programs. Organizations that have invested significantly in customer…
Privacy compliance is the set of activities an organization performs to satisfy regulatory requirements: maintaining records of processing activities, conducting data pro…
The Article 30 record of processing activities is supposed to be comprehensive. It documents every processing activity the organization conducts on personal data.
Purpose limitation under GDPR requires that personal data be collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with th…
The data subject access request arrived on a Tuesday. By the following Monday the privacy team had searched the CRM, the support ticketing system, the email archive, the…
