Although organizations have dealt with privacy issues for years, only in the past decade have they begun to view the complexities of privacy as requiring formal organizational structure, dedicated employees, and/or dedicated resources. While in some organizations “privacy” falls within the ambit of the legal department; other organizations have created offices that are focused solely on privacy issues and that report to a Chief Privacy Officer (“CPO”). There is little commonality in how these offices are staffed, funded, or organized. For example, while some CPOs report directly to senior management, others report through a General Counsel or a Chief Compliance Officer.

If you are creating a privacy office, or reviewing the scope of an existing office, consider the degree to which the office should be responsible for the following functions:

1. Drafting, reviewing, or revising privacy related policies and privacy related procedures (e.g., BYOD policy, website privacy policies, employee privacy codes of conduct).
2. Following privacy related legal developments and trends.
3. Training employees (g., providing core privacy training to the majority of employees, as well as specialized privacy training for employees that have contact with personal information).
4. Responding to privacy related complaints or questions.
5. Assisting the organization in negotiating contracts in which the organization is providing privacy related representations, warranties, guarantees, or indemnification (e., client-facing agreements).
6. Participating in the organization’s incident response team.
7. Assisting the organization when negotiating privacy provisions in contracts in which the organization is providing data to third parties (g., reviewing privacy practices of vendors and negotiating appropriate contractual guarantees).
8. Conducting a data inventory or a data map.
9. Monitoring or auditing the organization’s privacy-related practices.
10. Reporting to senior management any significant privacy related risks or concerns.
11. Managing the cross-border transfer of information between jurisdictions with different privacy standards.
12. Working with developers, designers, or marketers to design privacy protections into new products, services, or promotions.

    ---

    [View source.]