The extent of a security breach of personal information and possible damage(s) may not be identified.
The organization implements a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational privacy practices.
(1) COMPLAINT MANAGEMENT | RESPONSE TIMES
The organization responds to complaints, concerns, or questions from individuals within [Assignment: organization-defined time period].
An anonymous incident “hot-line” or similar should be available to employees for complaints, questions, and concerns.
No statewide control
Obtain data privacy policy and procedures; other relevant documents or records and ascertain if:
(I) the organization implements a process for receiving and responding to complaints, concerns, or questions from individuals about the organizational privacy practices.
(ii) the organization responds to complaints, concerns, or questions from individuals within organization-defined time period.
