Chapter 9 — Privacy and data protection: leadership and assurance
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Board reporting"]
N2["9.2 The dashboard"]
N3["9.3 Assurance"]
N4["9.4 Leadership"]
N5["Lab — Privacy risk indicators against board appetite"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Board reporting"]
N2["9.2 The dashboard"]
N3["9.3 Assurance"]
N4["9.4 Leadership"]
N5["Lab — Privacy risk indicators against board appetite"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Board reporting]
|
v
[9.2 The dashboard]
|
v
[9.3 Assurance]
|
v
[9.4 Leadership]
|
v
[Lab — Privacy risk indicators against board appetite]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) report privacy risk to a board with indicators; (2) set appetite thresholds; (3) provide assurance on the privacy programme.
9.1 Board reporting
Corvina's board wants to understand privacy risk. Priscila proposes six key risk indicators with thresholds approved by the board as its risk appetite: rights requests answered late, breaches notified late, processors without agreements, records past retention, DPIAs overdue for review and staff training overdue. Each has an amber threshold equal to the appetite and a red threshold at one and a half times the appetite. The indicators summarise complex operations in a form the board can monitor. Six indicators are chosen. Each has a clear source.
9.2 The dashboard
The lab compares current values with thresholds. Late rights requests are 4.0% against a 5.0% threshold, green. DPIAs overdue are 2 against 3, green. Training overdue is 10.5% against 10.0%, amber. Breaches notified late are 1 against 0.5, red. Processors without agreements are 6.0% against 2.0%, red. Records past retention are 11.0% against 5.0%, red. Three indicators are red. Priscila presents each red indicator with its cause and a remediation plan. Each red indicator has an owner and a date. The board asks why retention is so high, and Priscila explains that old systems had no deletion rules, which is the problem her applied project in chapter 11 will address directly over the following six months.
9.3 Assurance
The board asks whether the indicators can be trusted. Priscila arranges for internal audit to test two indicators each quarter, sampling underlying records. The first audit finds that the processors-without-agreements figure was understated because some vendors were missing from the register. The corrected figure is higher. She reports the correction openly. She notes that assurance must test both controls and the data used to report on them. Internal audit found that one system had been left out of the retention calculation, which made the indicator look better than it was.
9.4 Leadership
Priscila reflects on leadership. Board members respond to clear risks, trends and plans, not to technical detail. She learns to tell a short story for each red indicator: what is wrong, why it matters to customers, what will fix it and when. Dr. Ward notes that privacy leaders must earn board attention by being concise and accurate, and that honest corrections increase rather than reduce credibility over time. Her board papers never exceed two pages and always end with the decision she needs.
Lab — Privacy risk indicators against board appetite
# Privacy key risk indicators against board-approved appetite thresholds (amber at threshold, red at 1.5x).
kris = [("rights requests late (%)", 4.0, 5.0), ("breaches notified late (count/qtr)", 1, 0.5), ("processors without DPA (%)", 6.0, 2.0),
("records past retention (%)", 11.0, 5.0), ("DPIAs overdue for review", 2, 3), ("staff training overdue (%)", 10.5, 10.0)]
for name, v, t in kris:
st = "RED" if v >= 1.5 * t else "AMBER" if v >= t else "GREEN"
print(f"{name:36s} value {v:5.1f} threshold {t:4.1f} {st}")
Run with python3 lab_kri.py. Verified output:
rights requests late (%) value 4.0 threshold 5.0 GREEN
breaches notified late (count/qtr) value 1.0 threshold 0.5 RED
processors without DPA (%) value 6.0 threshold 2.0 RED
records past retention (%) value 11.0 threshold 5.0 RED
DPIAs overdue for review value 2.0 threshold 3.0 GREEN
staff training overdue (%) value 10.5 threshold 10.0 AMBER
Worked example
Priscila reports six indicators: three red (late breach notification, processors without agreements, records past retention), one amber (training) and two green, arranges audit testing and corrects an understated figure.
Synthetic case. Indicators and thresholds are synthetic.
Errors and limits
Indicators can be gamed; audit underlying data.
Exercises
- EX041 — Red indicators. Which indicators are red? Rubric: 3 = breaches notified late, processors without DPA, records past retention;; 2 = two;; 1 = wrong;; 0 = none.
- EX042 — Amber indicator. Which indicator is amber and why? Rubric: 3 = staff training overdue: 10.5% just above 10.0%;; 2 = names it;; 1 = vague;; 0 = none.
- EX043 — Red threshold. How is the red threshold defined? Rubric: 3 = 1.5 times the appetite threshold;; 2 = mentions multiple;; 1 = vague;; 0 = none.
- EX044 — Audit finding. What did internal audit find? Rubric: 3 = processors-without-agreements figure understated due to register gaps;; 2 = mentions understated;; 1 = vague;; 0 = none.
- EX045 — Board story. What four elements does Priscila use for each red indicator? Rubric: 3 = what is wrong, why it matters, what fixes it, when;; 2 = three;; 1 = vague;; 0 = none.
Synthesis
Chapter 9 leads and assures. Chapter 10 reads and critiques research.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →