Privacy Assessment

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so identified risk is treated rather than only recorded.

Each product or service to be certified undergoes ESRB's comprehensive privacy assessment, including review of privacy policy disclosures, data flows, parental notice and consent mechanisms, security policies and the SDKs/third parties used.

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so identified risk is treated rather than only recorded.

Requires the organisation to respond to findings from security and privacy assessments, monitoring and audits, so that identified risk is treated rather than only recorded.

Conduct Data Privacy Assessment (DPIA) under Section 325O.07 for high-risk processing activities. MANDATORY DPIA triggers: (a) processing of sensitive data; (b) processing for purposes of targeted advertising; (c) sale of personal data;

Execute the Assess step per NIST SP 800-37 Rev 2 Chapter 3 Step 5. Determine whether controls selected for implementation are implemented correctly + operating as intended + producing the desired outcome with respect to meeting the security and privacy require...