Data Privacy Compliance
Summary PIA (2018)
• Top 5 risks identified as HIGH RISK
1. Lack of Breach Management Program (In Patients, ER, MRD
and QMS, General ) [Risk of breach]
2. Physical access to work stations and records not
restricted (In patients, ER, MRD) [Risk of breach]
3. Inadequate Office/Storage Space (MRD) [Risk of breach]
4. Retention and Disposal policy not fully implemented
(Laboratory) [Risk of unauthorized processing, breach]
5. Procedure for release of results not consistently
followed (Radiology) [Risk of unauthorized processing, breach]
Summary PIA (2018)
• Most commonly identified risks
1. Lack of Breach Management Program (99) [Risk of breach]
2. Lack of Capacity Building Program (69) [Risk of breach]
3. Inadequate Security Measures (55) [Risk of breach]
4. Physical access to work stations and records not
restricted (52) [Risk of breach]
5. No Privacy Notice (45) [Risk of unauthorized processing,
breach]
6. Inadequate Procedure for data subjects to exercise rights
(45) [Risk of unauthorized processing, breach]
THE DATA PRIVACY ACCOUNTABILITY
AND COMPLIANCE FRAMEWORK
RISK
GOVERNANCE ORGANIZATION DAY TO DAY DATA SECURITY
ASSESSMENT
1. Choose a DPO 3. Conduct PIA 4. Privacy Management 6. Privacy Notice 15. Data Center
2. Register Program 7-12. Data Subject 16. Encryption
5. Privacy Manual Rights 17. Access Policy
13. Retention 18. Transfers
14. Disposal
BREACHES THIRD PARTIES MANAGE HR PROJECTS MANAGE LEGAL
19. Breach Management; 20. Third Parties; 21. Training 22. Conduct and 23. Monitor Legal
Assessment Due Diligence Update PIA Compliance
Monitoring Agreements • Contract Review
Response Team Notification
Review Access Policy
Notification
Immediate Recommendations
• Designate a Data Protection Taskforce
• “The personal information controller shall designate an individual or
individuals who are accountable for the organization’s compliance with
this Act. The identity of the individual(s) so designated shall be made
known to any data subject upon request.” (Sec. 21, DPA)
• Develop a Security Incident Policy
• Require Employee Orientation on the Data Privacy Act
• Develop and Implement a Privacy Management Program
Related Recommendations
• For review:
• Social Media Policy (1st Draft Done)
• CCTV Policy (1st Draft Done)
Thank you!
