Short answer
Privacy management applies privacy requirements to the collection, use, sharing, retention, and deletion of personal data. It assesses documented decisions and controls without claiming that risk can be eliminated.
About Privacy management
Applies privacy requirements to the collection, use, sharing, retention, and deletion of personal data. The competency supports accountable data practices but does not guarantee compliance or the absence of privacy incidents.
Use this competency for
- Roles that assess personal data uses, maintain privacy records, or coordinate data rights work.
- Functions accountable for privacy controls, data inventories, retention, sharing, or privacy reviews.
Do not use this competency for
- Roles that merely access personal data under established procedures and own no privacy decisions or controls.
Important distinctions
Information security
Information security protects information from threats. Privacy management governs whether and how personal data is collected, used, shared, retained, and deleted.
Regulatory compliance
Regulatory compliance spans applicable regulatory duties. Privacy management focuses specifically on personal data practices and related decisions.
Expectations by level
IC1
Processes privacy tasks
Completes defined privacy tasks with guidance, follows current verification and record procedures, and escalates requests or data uses outside the approved path.
Observable behaviors
- Verifies required details before processing a data rights request.
- Updates the data or retention record when an approved change occurs.
- Escalates a new data use or sharing request with the known purpose and parties.
Examples
- Logged a deletion request with identity verification and affected systems recorded.
- Flagged a proposed data export because its recipient was absent from the approved record.
IC2
Owns privacy reviews
Independently assesses privacy questions for a defined area, resolves incomplete data-flow evidence, and coordinates controls and decisions with accountable owners.
Observable behaviors
- Maps collection, purpose, access, sharing, retention, and deletion for a data use.
- Documents options, open assumptions, and required specialist decisions.
- Tracks privacy actions through implementation and evidence review.
Examples
- Reviewed a new analytics flow and reduced collected fields to those tied to the stated purpose.
- Found conflicting retention settings across systems and coordinated a documented correction.
IC3
Sets privacy practices
Defines privacy management standards across teams, frames unfamiliar data practices for decision, and establishes reusable review, inventory, and control patterns.
Observable behaviors
- Defines shared privacy review criteria and decision ownership.
- Reviews cross-system data flows for purpose and lifecycle gaps.
- Uses request, incident, and review evidence to prioritize program changes.
Examples
- Established one data inventory method after teams recorded sharing in incompatible ways.
- Set a privacy review pattern for new data uses across several product groups.