0 / 24

Model 55 of 74 · Risk & Compliance

Privacy & Data Protection Maturity Assessment

Evaluate privacy practices, data protection controls, and compliance readiness.

Pillars & areas

Govern

Set the rules

  1. 01Privacy Governance & Accountability
  2. 02Data Collection & Consent

Protect

Manage the data

  1. 03Data Lifecycle Management
  2. 04Rights & Transparency

Defend

Guard the boundaries

  1. 05Privacy by Design & Breach Readiness
  2. 06Third-Party & Cross-Border Data

Levels

  1. 1Policy-on-PaperPrivacy as afterthought
  2. 2OperationalisedDocumented & assigned
  3. 3Privacy by DesignEmbedded in culture

01 Privacy Governance & Accountability

Does the organisation have clear ownership, policies, and oversight structures for privacy?

0/4 answered

PG-1Who is accountable for privacy within your organisation?

Think about whether there is a named individual or role with explicit responsibility for privacy outcomes, or whether it falls to whoever happens to be involved.

PG-2How does your organisation maintain and enforce privacy policies?

Consider whether privacy policies exist only on paper or whether staff actually follow them and whether non-compliance has consequences.

PG-3How does your organisation ensure staff understand their privacy obligations?

Think about whether training goes beyond a tick-box exercise and whether people in high-risk roles receive targeted guidance.

PG-4How does your organisation track and manage its data processing activities?

Consider whether you have a current, accurate record of what personal data you hold, why, and where it flows.

02 Data Collection & Consent

Does the organisation collect only what it needs and obtain meaningful permission where required?

0/4 answered

DC-1How does your organisation determine what personal data to collect?

Think about whether data collection is driven by a documented need or whether teams default to collecting everything available.

DC-2How does your organisation obtain and record consent where it is the legal basis for processing?

Consider whether consent is genuinely informed and freely given, or whether it is buried in terms and conditions that nobody reads.

DC-3How does your organisation handle consent withdrawal or changes in processing purpose?

Think about what actually happens in your systems when someone withdraws consent — does processing stop promptly, or does it continue unchecked?

DC-4How does your organisation assess and document the legal basis for each processing activity?

Consider whether someone could look up any given processing activity and immediately find its documented legal basis and justification.

03 Data Lifecycle Management

Does the organisation manage personal data responsibly from creation through to deletion?

0/4 answered

DL-1How does your organisation manage retention and deletion of personal data?

Think about whether data is kept indefinitely 'just in case' or whether there are enforced retention schedules that result in actual deletion.

DL-2How does your organisation classify and label personal data based on sensitivity?

Consider whether staff can tell at a glance whether a dataset contains sensitive personal data and what handling rules apply.

DL-3How does your organisation protect personal data at rest and in transit?

Think about whether encryption and access controls are consistently applied or whether there are gaps — such as unencrypted laptops, email attachments, or shared drives with open permissions.

DL-4How does your organisation handle de-identification when personal data is used for analytics, testing, or research?

Consider whether production personal data is copied into test environments or analytics platforms without any transformation.

04 Rights & Transparency

Can individuals understand, access, correct, and control their personal data effectively?

0/4 answered

RT-1How does your organisation handle individual rights requests such as access, correction, or deletion?

Think about what happens when someone asks to see, fix, or delete their data — is there a clear, timely process or does it depend on who receives the request?

RT-2How clear and accessible are your privacy notices to individuals?

Consider whether a typical user can actually understand what you do with their data after reading your privacy notice, or whether it is written in legal language that obscures more than it reveals.

RT-3How does your organisation provide individuals with visibility into how their data is used?

Think about whether individuals can find out which of your systems hold their data, who has accessed it, and for what purpose.

RT-4How does your organisation handle data portability requests?

Consider whether you can provide an individual's data in a structured, machine-readable format that they or another organisation can actually use.

05 Privacy by Design & Breach Readiness

Does the organisation design privacy in from the start, and can it detect and respond to personal data breaches effectively?

0/4 answered

SB-1How does your organisation conduct privacy impact assessments for new or changed processing?

Think about whether privacy risks are assessed before a new project, system, or vendor goes live — or whether they are discovered after launch.

SB-2How prepared is your organisation to detect a personal data breach?

Consider whether you would know within hours if personal data was accessed, exfiltrated, or altered by an unauthorised party.

SB-3How does your organisation respond to and report personal data breaches?

Think about whether there is a rehearsed plan that staff know how to activate, or whether a breach would trigger confusion about who does what.

SB-4How does your organisation embed privacy into the design of new products, systems, and processes?

Consider whether privacy requirements are included in design specifications from the start, or bolted on late in the process when problems emerge.

06 Third-Party & Cross-Border Data

Does the organisation manage privacy risk when personal data is shared with or processed by external parties or across jurisdictions?

0/4 answered

TP-1How does your organisation assess the privacy practices of third-party vendors and partners before sharing personal data?

Think about whether you evaluate a vendor's data protection posture before signing a contract, or whether you rely on trust and brand reputation alone.

TP-2How does your organisation manage data processing agreements with third parties?

Consider whether agreements cover what the vendor can and cannot do with personal data, and whether anyone monitors compliance with those terms.

TP-3How does your organisation manage cross-border transfers of personal data?

Think about whether you know which jurisdictions personal data flows to, and whether appropriate safeguards are in place for each transfer.

TP-4How does your organisation maintain oversight of sub-processors used by its vendors?

Consider whether you know who your vendors' vendors are — the sub-processors that also handle your personal data — and whether you have any control over that chain.

Self-assessment report

Privacy & Data Protection

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Privacy & Data Protection maturity model

Privacy is not a compliance checkbox -- it is a measure of how much an organisation genuinely respects the people whose data it holds. Mature privacy practices go beyond satisfying regulatory requirements: they reflect an organisational commitment to collecting only what is needed, being transparent about how data is used, giving individuals meaningful control, and building systems that protect personal data by design rather than by afterthought.

This model assesses privacy maturity not by asking whether policies exist, but by examining whether those policies translate into observable behaviours, enforceable controls, and measurable outcomes. An organisation that scores well here does not merely avoid penalties -- it earns and sustains the trust of its customers, employees, and partners.

The Privacy & Data Protection maturity model evaluates six interconnected areas that together represent the full scope of organisational privacy capability. It covers governance structures and accountability, how data is collected and consent is managed, how data is handled throughout its lifecycle, how individual rights are respected, how breaches are prevented and managed, and how privacy risk is controlled when data crosses organisational and jurisdictional boundaries.

The model uses 24 questions across six areas, each scored at three maturity levels. It is designed to surface practical gaps -- not theoretical ones -- by asking what actually happens rather than what is documented.

Who this assessment is for

This model is designed for:

  • Privacy and data protection officers seeking a structured way to benchmark current capabilities and prioritise investment.
  • Chief Information Security Officers and IT leaders who need to understand how well privacy controls are embedded into technology and operations.
  • Risk and compliance professionals building a privacy posture that goes beyond regulatory minimums.
  • Senior leadership and board members who want a clear, jargon-free view of organisational privacy risk.
  • Organisations preparing for regulatory scrutiny under data protection laws such as GDPR, CCPA/CPRA, LGPD, POPIA, or Australia's Privacy Act, who need to identify and close gaps before an audit or incident forces the issue.

No specific regulatory knowledge is required to complete the assessment, though familiarity with your organisation's data processing activities will produce more accurate results.

The three maturity levels

  • Level 1 -- Policy-on-Paper: Privacy practices are informal, inconsistent, and largely driven by individual awareness rather than organisational systems. Personal data handling varies across teams. Policies may exist on paper but are not actively followed or enforced. Breaches and rights requests are handled in an improvised manner, and the organisation discovers privacy problems only after they cause harm. At this level, privacy is a risk the organisation carries without measuring or managing it.
  • Level 2 -- Operationalised: Privacy is managed through documented policies, assigned roles, and repeatable processes. The organisation knows what personal data it holds, why, and on what legal basis. Consent is obtained meaningfully, rights requests are fulfilled within regulatory timelines, and breach response follows a defined plan. Vendor agreements include data protection terms. At this level, privacy is a managed function -- controls exist and are applied, though they may rely on manual effort and periodic review rather than continuous enforcement.
  • Level 3 -- Privacy by Design: Privacy is embedded into organisational culture, technology architecture, and strategic decision-making. Controls are automated where possible, continuously monitored, and improved based on evidence. The organisation anticipates regulatory changes, proactively reduces its data footprint, and designs new products and services with privacy as a first-class requirement. Individuals have meaningful visibility and control over their data. At this level, privacy is a competitive advantage and a reflection of organisational values, not merely a compliance obligation.

The 6 areas assessed

1. Privacy Governance & Accountability

Examines whether the organisation has clear ownership, enforceable policies, effective training, and a current record of its data processing activities. Strong governance is the foundation -- without it, every other privacy capability is unreliable. This area assesses whether privacy is someone's explicit job, whether policies are living documents or shelf-ware, whether staff genuinely understand their obligations, and whether the organisation maintains an accurate inventory of what it does with personal data.

2. Data Collection & Consent

Evaluates whether the organisation collects only what it needs and obtains meaningful, informed permission where consent is the legal basis for processing. This area looks at data minimisation practices, the quality and granularity of consent mechanisms, the ability to act on consent withdrawal, and the rigour of legal basis assessments. Organisations that score well here collect deliberately, explain clearly, and respect choices promptly.

3. Data Lifecycle Management

Assesses how personal data is managed from the moment it enters the organisation until it is securely deleted. This covers retention and deletion practices, data classification, protection at rest and in transit, and de-identification for secondary uses such as analytics or testing. Mature organisations do not simply accumulate data -- they actively govern its journey and ensure it is protected, minimised, and disposed of responsibly.

4. Rights & Transparency

Measures how effectively individuals can understand, access, correct, port, and delete their personal data. This area examines the process for handling rights requests, the clarity and accessibility of privacy notices, the level of visibility individuals have into how their data is used, and the organisation's ability to support data portability. Transparency is not just about disclosure -- it is about making information genuinely usable by the people it concerns.

5. Privacy by Design & Breach Readiness

Evaluates the organisation's ability to prevent, detect, and respond to personal data breaches, as well as its commitment to privacy-by-design. This area covers privacy impact assessments, breach detection capabilities, incident response planning and rehearsal, and the integration of privacy requirements into system and product design. Mature organisations treat breaches as a matter of when, not if, and design systems that limit the blast radius when incidents occur.

6. Third-Party & Cross-Border Data

Assesses how the organisation manages privacy risk when personal data is shared with vendors, partners, or processed across jurisdictions. This covers vendor privacy assessments, the quality and enforcement of data processing agreements, cross-border transfer mechanisms, and sub-processor oversight. In a world of cloud services, global supply chains, and complex data ecosystems, privacy cannot stop at the organisational boundary.

How this model relates to other frameworks

  • GDPR (EU General Data Protection Regulation)
  • CCPA / CPRA (California Consumer Privacy Act / California Privacy Rights Act)
  • NIST Privacy Framework 1.0
  • ISO/IEC 27701 (Privacy Information Management System)
  • LGPD (Brazil's General Data Protection Law)
  • POPIA (South Africa's Protection of Personal Information Act)
  • Australia Privacy Act 1988 and Australian Privacy Principles
  • APEC Cross-Border Privacy Rules
  • OECD Privacy Guidelines

Frequently asked questions

What is the Privacy & Data Protection maturity model?

Evaluate privacy practices, data protection controls, and compliance readiness. It is an original, simplified model with three maturity levels (Policy-on-Paper, Operationalised and Privacy by Design), assessed through 24 questions across 6 areas: Privacy Governance & Accountability, Data Collection & Consent, Data Lifecycle Management, Rights & Transparency, Privacy by Design & Breach Readiness and Third-Party & Cross-Border Data.

How long does the Privacy & Data Protection assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Policy-on-Paper), 2 (Operationalised) or 3 (Privacy by Design). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.