Privacy Maturity Model

This document provides a framework for developing, implementing, maintaining, and evaluating privacy programs within organizations. Privacy programs must be comprehensive enough to address all requirements established by authoritative sources (e.g., laws, regulations, guidance), and must be supported by written policies, appropriate training, ongoing practices, and appropriate assessment. This document may be used to assess both the completeness(whether an organization has identified and implemented all elements of a privacy program), and maturity level(an evaluation of to what degreepractices supporting each element are effective in achieving their intended purpose)of a privacy program. The framework was developed based not only on comprehensive research of relevant laws and guidance, but on practices that have been assessed as effective in many organizations.