Overview
Project 4 – Privacy Compliance Strategy
Description
For this project, you will leverage your research from Projects #1, #2, and #3 to develop a privacy
compliance strategy for your chosen company. The deliverable for this project will be a Privacy
Compliance Strategy that includes a legal and regulatory analysis for privacy laws and regulations. The
scope for this project will be laws and regulations from the United States (federal and state) and the
European Union.
Research
1. Begin your research by reviewing the privacy concepts and requirements presented in the (ISC)2
SSCP Systems Security Certified Practitioner Official Study Guide (the course textbook).
2. Review your selected company’s Form 10-K to identify privacy related risks which the company
disclosed to investors and shareholders. You will use these and additional privacy-related risks,
identified through your readings and research, to construct a privacy compliance profile.
3. Read Chapters 1 and 2 of the NIST Privacy Framework: A tool for improving privacy through
enterprise risk management. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf
4. Review the Audit and Compliance control family in NIST SP 800-53 (section 3.3).
5. Review one or more reports written by privacy analysts about privacy issues affecting global
businesses:
a. 2010 Ponemon Report: How Global Organizations Approach the Challenge of Protecting
Personal Data
https://www.ponemon.org/local/upload/file/ATC_DPP%20report_FINAL.pdf
b. 2019 Thomson Reuters GDPR Report Business’ struggle with data privacy: Regulatory
environment continues to evolve rapidly
https://legalsolutions.thomsonreuters.co.uk/blog/wp-content/uploads/sites/14/2019/1
2/Thomson-Reuters-GDPR-Report.pdf
c. 2021 blog from PrivacyPolicies.com Global Privacy Laws Explained
https://www.privacypolicies.com/blog/global-privacy-laws-explained/
6. Review existing and proposed privacy legislation for U.S. jurisdictions (states): Association of
Privacy Professionals (IAPP)
https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
7. Review the privacy guidance for the European Union’s General Data Protection Regulation
https://gdpr.eu/
8. Review the Fact Sheet for the Trans-Atlantic Data Privacy Framework
https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-
states-and-european-commission-announce-trans-atlantic-data-privacy-framework/
9. Find and review additional authoritative sources which discuss (a) specific privacy-related legal
or regulatory non-compliance events (lawsuits, fines, etc.) impacting large, global companies and
(b) the business and financial impacts arising from compliance failures (violations) for privacy
laws and regulations.