Privacy Frameworks

Why Privacy Frameworks Matter in the CRMA Exam
Privacy has moved from a compliance footnote to a board-level risk. Organizations collect, store, share, and monetize enormous volumes of personal information, and the consequences of mishandling it are severe: regulatory fines (GDPR penalties can reach 4% of global annual turnover), class-action litigation, loss of customer trust, operational disruption after a breach, and reputational damage that can take years to repair. For the CRMA candidate, privacy sits squarely inside the domain of Evaluating Risk Management Processes because an organization cannot claim to have an effective enterprise risk management (ERM) system if privacy risk is not identified, assessed, mitigated, and monitored like any other significant risk.

The IIA explicitly expects internal auditors to address privacy. The Global Internal Audit Standards (and the earlier Standard 2130.A1) require internal audit to evaluate the adequacy and effectiveness of controls over the reliability and integrity of information and the safeguarding of assets, and the IIA Practice Guide Auditing Privacy Risks (originally GTAG 5) gives detailed guidance on how to do it. Exam questions therefore test whether you understand what a privacy framework is, how it is used to structure a privacy program, and how an internal auditor provides assurance over it rather than owning it.

What Is a Privacy Framework?
A privacy framework is a structured set of principles, practices, and controls that an organization adopts to govern how it collects, uses, retains, shares, protects, and disposes of personal information. Think of it as the privacy equivalent of COSO for internal control: it does not tell you exactly which technology to buy, but it defines the objectives and components a sound privacy program must contain, and it gives auditors a recognized benchmark against which to evaluate management's practices.

Key distinction for the exam: privacy is not the same as information security. Security is about protecting information (of any kind) from unauthorized access, alteration, or destruction. Privacy is about the appropriate handling of personal information: whether the organization had the right to collect it in the first place, whether it told the individual, whether it uses it only for the stated purpose, whether it keeps it too long, and whether individuals can access and correct it. Security is one necessary component of privacy, but a perfectly secured database of data collected without consent is still a privacy failure.

The Major Privacy Frameworks You Should Recognize

1. OECD Privacy Guidelines (1980, updated 2013) - the foundation of nearly every later framework. Eight principles: Collection Limitation, Data Quality, Purpose Specification, Use Limitation, Security Safeguards, Openness, Individual Participation, and Accountability.

2. Fair Information Practice Principles (FIPPs) - the US-centric articulation of similar ideas, commonly summarized as Notice, Choice, Access, Security, and Enforcement/Redress. Widely referenced by the FTC and US agencies.

3. Generally Accepted Privacy Principles (GAPP) - developed by the AICPA and CICA (now CPA Canada) and heavily referenced by the IIA in its privacy guidance. GAPP contains ten principles: (1) Management, (2) Notice, (3) Choice and Consent, (4) Collection, (5) Use, Retention and Disposal, (6) Access, (7) Disclosure to Third Parties, (8) Security for Privacy, (9) Quality, and (10) Monitoring and Enforcement. GAPP is popular with auditors because each principle is broken into measurable criteria, making it ideal for building an audit program. It also underpins the Privacy criteria in the AICPA Trust Services Criteria used in SOC 2 reports.

4. NIST Privacy Framework (2020) - a voluntary, outcome-based tool structured like the NIST Cybersecurity Framework. Its Core has five functions: Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P, supported by Profiles (current vs target state) and Implementation Tiers (maturity). Useful for organizations that want a risk-based rather than a rules-based approach.

5. ISO/IEC 29100 and ISO/IEC 27701 - ISO 29100 provides a privacy framework and eleven privacy principles for ICT systems; ISO 27701 extends ISO 27001/27002 into a certifiable Privacy Information Management System (PIMS), covering both controllers and processors.

6. Regulatory frameworks - the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act/CPRA, Canada's PIPEDA, Brazil's LGPD, the APEC Privacy Framework and Cross-Border Privacy Rules, and sector laws such as HIPAA (health) and GLBA (financial). GDPR's seven principles (lawfulness/fairness/transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability) map almost directly onto the OECD principles. These laws are not frameworks in the voluntary sense, but they define the compliance obligations a framework must help the organization meet.

How a Privacy Framework Works in Practice
Regardless of which framework is chosen, a mature privacy program follows a recognizable lifecycle that the auditor evaluates step by step:

Governance and accountability. Senior management and the board set the tone; a Chief Privacy Officer or Data Protection Officer is accountable; privacy policies are approved, communicated, and periodically reviewed. Roles of data controller (decides why and how data is processed) and data processor (processes on behalf of the controller) are clearly understood.

Data inventory and classification. You cannot protect what you do not know you have. A data inventory or record of processing activities identifies what personal information exists, where it resides, where it flows (including cross-border transfers), who can access it, and why it is held. Sensitive categories (health, biometrics, financial, children's data) receive heightened controls.

Risk assessment. Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) are performed for new systems, processes, products, or vendors that handle personal data, ideally before implementation (privacy by design). Risks are rated for likelihood and impact to both the organization and the individual.

Control implementation. Controls span the data lifecycle: lawful collection with notice and consent; data minimization; purpose limitation; access controls and encryption; retention schedules and secure disposal; procedures for individuals to access, correct, delete, or port their data; vendor due diligence and contractual clauses; and incident/breach response plans with regulatory notification timelines (for example, 72 hours under GDPR).

Monitoring and enforcement. Training and awareness, compliance monitoring, metrics and KPIs reported to the board, complaint handling, periodic internal and external audits, and corrective action for violations.

The Internal Auditor's Role
Under the IIA's guidance, internal audit should: assess whether management has adopted an appropriate framework and whether the privacy program is aligned to the organization's risk appetite and legal obligations; evaluate the design and operating effectiveness of privacy controls; confirm that privacy risks are integrated into the ERM process rather than siloed in IT or Legal; and report gaps to senior management and the board. Internal audit may advise on framework selection and design but must not own the privacy program, set privacy policy, or make management decisions, because that would impair independence. If internal audit lacks privacy expertise, the Standards require it to obtain competent advice and assistance.

Exam Tips: Answering Questions on Privacy Frameworks

Tip 1 - Spot the principle being tested. Most scenario questions describe a single failure. Match it to a principle: data kept indefinitely = Retention/Storage Limitation; customers not told how data is used = Notice/Openness; marketing data used for credit decisions = Purpose/Use Limitation; inaccurate records = Quality/Accuracy; vendor loses data = Disclosure to Third Parties/Accountability; no one responsible = Management/Governance.

Tip 2 - Separate privacy from security. If an answer choice fixes only the technical safeguard (encryption, firewalls) but the scenario is about consent, purpose, or retention, that answer is a distractor. Security is one principle among many.

Tip 3 - When asked for the first or most important step, think inventory and governance. The best starting point for a privacy risk assessment or audit is understanding what personal data the organization holds, where it flows, and which laws apply. Policy writing and control testing come later.

Tip 4 - Respect independence. Eliminate answers where internal audit writes the privacy policy, approves vendor contracts, owns the breach response, or acts as the Data Protection Officer. The correct answer has internal audit evaluating, assessing, recommending, or providing assurance.

Tip 5 - Use a recognized framework as the benchmark. If the question asks how internal audit should evaluate the privacy program, the best answer typically involves comparing it against an established framework (GAPP, NIST, ISO 27701, OECD) and applicable regulations, not against the auditor's personal judgment or industry anecdotes.

Tip 6 - Remember privacy is an enterprise risk. Answers that integrate privacy into ERM, link it to risk appetite, and involve the board and senior management are usually stronger than answers that treat privacy as purely an IT or legal matter.

Tip 7 - Think lifecycle. When evaluating controls, the exam rewards answers that cover collection through disposal. An answer that addresses only collection or only storage is incomplete compared with one that addresses the full lifecycle.

Tip 8 - Third parties are still your risk. Outsourcing processing does not outsource accountability. Look for due diligence, contractual privacy clauses, right-to-audit provisions, and ongoing monitoring of vendors.

Tip 9 - Know the vocabulary. Be comfortable with terms such as controller vs processor, PIA/DPIA, privacy by design, data minimization, data subject rights, breach notification, cross-border transfer, and PIMS. Questions often hinge on recognizing a term.

Tip 10 - Prefer preventive and proactive over reactive. If choices include performing a PIA before system implementation versus investigating after a complaint, the proactive option reflects better risk management and privacy by design.

Quick Self-Check
A company launches a mobile app that collects location data and later sells it to advertisers without telling users. Which principles are violated? Notice/Openness, Choice and Consent, Purpose Specification/Use Limitation, and Disclosure to Third Parties. What should internal audit recommend? That management adopt and apply a recognized privacy framework, perform PIAs before launching new data-driven products, update privacy notices and consent mechanisms, and report privacy risk to the board as part of ERM. If you can reason through that example fluently, you are well prepared for privacy framework questions on the CRMA exam.