Appoint a Privacy Officer
Best Practice:
Appoint an individual (or individuals) to be responsible for your organization’s privacy compliance. Label these privacy officer(s) on your website privacy policy or contact page with instructions on how a user can submit a request, and what the time limit for your response will be, which should be within 30 days.
Privacy Officer References in CSA, PIPEDA, and OECD:
Model Code for the Protection of Personal Information (CAN/CSA-Q830-96; published March 1996; reaffirmed 2001): (which is also schedule 1 of PIPEDA) An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with the following principles.
OECD 14. Accountability principle:
A data controller should be accountable for complying with measures which give effect to the principles stated above.
This page last updated May 7, 2015.
Need this translated for your organization? PrivaSecTech offers confidential briefings, policy reviews, workshops, and privacy/security advisory for teams that need to decide what to do next.
