Privacy Audits 101
summary
Defines privacy audit as evidence-based, scope-limited testing of stated controls, not investigations or pen tests, and shows a real example: PwC audit of Facebook (2017) clears sampled controls even while Cambridge Analytica leak exists, illustrating audits are backward‑looking and limited. Explains sampling methodology — pick a population, choose a sample (eg, 10 of 100 DSARs), set tolerance, inspect records — and compares three frameworks (AICPA, NIST, ISO 27701) to show which controls would have required disclosure records or downstream notification.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:46Why Are We Talking about a Privacy Audit
- 1:36What Is a Privacy Audit
- 3:34The Pwc Audit of Facebook in 2017
- 7:21Privacy Frameworks
- 9:13Agreements and Commitments
- 9:34Consent
- 10:13Facebook Did Not Cover Records of Disclosure
- 10:40Are Privacy Audits Effective
related talks
01h 22mAccountability in Practice
16mCache-22: Doing Privacy Engineering with Privacy Standards
37mFrom the Trenches Privacy Engineering Pitfalls Successes
16mPrivacy Review for Non-Maniacs
49mNew Way of Tackling Privacy Assessments
46mDeveloping for Privacy
01h 12mInvestigating algorithmic systems - Algorithm auditing.
42mPrivacy as a Brand Differentiator