Which privacy laws does your company align its privacy practices with?
Does your company sell personal data to third parties?
What are your retention policies regarding personal data?
Does your company provide transparency about the types of personal data collected and the purposes for which it is used?
Does your company have a designated privacy officer or team responsible for overseeing privacy practices?
Do you conduct privacy due diligence on third-party companies you share personal data with?
Does your company enter into agreements with third parties it engages with and shares personal data with?
How do you ensure the accuracy and integrity of personal data?
Does your company conduct regular privacy impact assessments (PIAs) or data protection impact assessments (DPIAs) to identify and mitigate privacy risks?
How does your company ensure ongoing compliance with privacy laws and regulations?
Does your company provide training to employees on privacy awareness and data protection practices?
How often does your company review and update its privacy policies and practices?
Where is the personal data your process stored?
How does your company address concerns about data transfers across international borders?
Who within your company has access to the personal data?
How does your company ensure the security of personal data?
What measures does your company take to protect personal data from unauthorized access or disclosure?
How does your company respond to data breaches or security incidents involving personal data?
What mechanisms does your company have in place for obtaining user consent for data processing?
Do you have a process in place for handling data subject requests?
How does your company handle requests from individuals to exercise their privacy rights?
Do you offer users control over their personal data, such as the ability to opt-out of certain data collection practices?
AICPA SOC 2