A data governance strategy has been defined by the IT strategy committee which includes privacy...

The IT strategy committee should mandate the creation of a data privacy policy next, because this would provide a formal and consistent framework for implementing and enforcing the data governance strategy and the privacy objectives related to access controls, authorized use, and data collection. A data privacy policy should define the roles and responsibilities of the data owners, stewards, custodians, and users, and specify the principles, standards, and procedures for collecting, processing, storing, sharing, and disposing of personal data in compliance with the legal and regulatory requirements12. A data privacy policy should also include the mechanisms for monitoring and auditing the data privacy practices, and for handling any data breaches or incidents12. References := ISACA, CGEIT Review Manual, 7th Edition, 2019, page 57-58.