risk
Privacy-program non-compliance (GDPR, CCPA, state laws)
Failure to honour data-subject rights (access, deletion, portability, restriction) on time, missing lawful-basis/consent documentation, defective consent mechanisms, invalid cross-border transfer mechanisms, or inadequate notices — driving fines and private rights of action.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- privacy
- domain
- Data Protection & Privacy
- Compliance, Audit & Assurance
- taxonomy
- nist-privacy-risk
- enterprise-risk
- inherent_rating
- high
Details
- risk_id
- data-privacy-program-noncompliance
- category
- privacy
- likelihood
- high
- impact
- high
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- nist-privacy-risk
- enterprise-risk
Source
No record-specific source URL is provided.
Connections
- UC-DATA-05 — Provide privacy notices and transparency to data subjects mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Maintaining legally-required notices and registrations addresses the inadequate-notice driver of regulatory non-compliance.
- UC-AI-17 — Define customer data-use and output-rights policies for AI services mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- Customer-facing input and output data policies (training use, retention, ownership, opt-out, deletion) are the notice-and-consent backbone of a privacy program for AI services.
- UC-DATA-17 — Resolve privacy inquiries, complaints, and disputes mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Correcting identified deficiencies and monitoring complaint trends catches and remediates compliance gaps.
- UC-DATA-11 — Control data flows, leakage, and cross-border transfers mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Valid, documented transfer mechanisms remove the invalid-cross-border-transfer driver of non-compliance.
- UC-DATA-14 — Maintain and provide an accounting of disclosures mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Providing accountings on verified request fulfills a data-subject right, supporting compliance.
- UC-DATA-01 — Process personal data only under a documented lawful basis mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- Recording the lawful basis in a register removes the 'missing lawful-basis documentation' driver of regulatory fines and private actions.
- UC-DATA-16 — Bind third parties handling personal data to privacy commitments mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Written processor commitments and their enforcement support the organization's data-protection compliance obligations.
- UC-DATA-02 — Obtain and honor consent for collection, use, and disclosure mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- Valid consent capture, records, and honored withdrawals/opt-outs remove the defective-consent-mechanism driver of fines and private actions.
- UC-DATA-06 — Provide data subjects access to their personal data mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Fulfilling access requests within statutory deadlines addresses the failure-to-honor-DSR driver of non-compliance.
- UC-DATA-07 — Keep personal data accurate and honor correction requests mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Executing/denying correction requests within statutory deadlines addresses the DSR-timeliness driver of non-compliance.
- UC-DATA-08 — Execute deletion and other rights requests within deadlines mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- primary
- rationale
- A verified process executing erasure/portability/restriction/objection within statutory clocks is the core defense against failing to honor DSRs on time.
- UC-AUDIT-26 — Authorize systems and internal connections before operation mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- The pre-operation authorization decision forces privacy requirements to be assessed before a system or internal connection is used.