# Privacy program: first 90 days checklist

Use this when you have been asked to build or take over a privacy program. The order follows the six
domains of the IAPP CIPM Body of Knowledge, version 4.2.0: framework, governance, then the operational
life cycle of assessing, protecting, sustaining and responding.

## Framework (weeks 1 to 3)

- [ ] Program scope written down, and a privacy strategy agreed with leadership
- [ ] Vision and mission statement for the program, communicated
- [ ] The laws, regulations and standards in scope, listed by jurisdiction and business line

## Governance (weeks 2 to 6)

- [ ] Policies and processes for each stage of the program life cycle, drafted or reviewed
- [ ] Roles and responsibilities named, including who decides, who advises and who executes
- [ ] Privacy metrics chosen for oversight, each tied to a decision it will drive
- [ ] Training and awareness plan, including how front-line staff recognize a rights request

## Assess (weeks 4 to 10)

- [ ] Data inventory and data governance systems documented
- [ ] Processors and third-party vendors evaluated
- [ ] Physical, environmental and technical controls evaluated
- [ ] A triage step (privacy threshold assessment) to decide which projects need a full PIA or DPIA
- [ ] Any merger, acquisition or divestiture checked for shared-data risk

## Protect (weeks 6 to 12)

- [ ] Information security practices and policies aligned with the privacy program
- [ ] Privacy by Design principles built into project intake
- [ ] Data use guidelines in place, with technical controls that enforce them

## Sustain (from week 8)

- [ ] Program performance measured against the chosen metrics
- [ ] An audit of the program planned
- [ ] Continuous assessment built into the calendar

## Respond (from day 1)

- [ ] A route for data subject access and rights requests, including requests that never use the word privacy
- [ ] Incident handling and response procedures, tested
- [ ] A date to review and improve the incident response plan