A conceptual framework for integrated information privacy protection

Abstract

Successful organizations strive to achieve a high degree of corporate governance, effective techniques for risk management, and an assurance regarding the fulfilment of compliance requirements. This effort bears the Governance, Risk and Compliance (GRC) label, which entails integrating these three disparate disciplines to achieve effectiveness and efficiency in meeting the organization's strategic objectives. An interesting development has been the integration of privacy within a GRC context. Privacy has a number of elements, including governance, management, legal, technical aspects, compliance, risk management, information security, business processes and organizational issues which fall into the GRC processes. A large number of privacy breaches and a growing number of privacy regulations will steer organizations in the realm of managing privacy protection within a GRC context. There are a number of privacy facets but the focus of this paper is specifically on information privacy protection. This paper seeks to develop a formalized and repeatable conceptual framework to address information privacy protection within a GRC frame of reference.