Privacy Program Operations

 

Resource Center / Topic Pages / Privacy Program Operations

Image

Privacy Program Operations

TOPIC PAGE

Navigate Page

On this topic page, you can find the IAPP’s collection of coverage, analysis and resources covering privacy program operations.

  • expand_more

    Privacy Program Management

    This IAPP textbook for the Certified Information Privacy Manager (CIPM) program provides critical knowledge for managing privacy program governance and operations.
    View here

    Strategic Privacy by Design
    This IAPP textbook contains a methodology for building privacy into a product, service, or business process.
    View here


News Articles

View all News Articles

Navigate 2025: How individuals’ feelings inform AI governance practices


There’s no opting-out of universal opt-outs


Rebuilding digital trust: How blockchain is making privacy a default


What Brazil’s ANPD expects from companies using generative AI


From compliance cost to competitive edge: How privacy leaders can command the executive table


Key takeaways from Ireland’s DPC annual report


Meta’s risk assessment updates look toward ‘holistic’ approach


Japan passes innovation-focused AI governance bill


The myth of anonymization: Why AI needs a new privacy paradigm


The quiet revolution in workplace tech


Privacy and security: Better together


Key considerations when setting up model data protection clauses


The shadow data market: Privacy risks lurking in forgotten information


How to implement effective privacy training


10 areas for US-based privacy programs to focus in 2025


New tools aim to improve data activity monitoring, compliance efficiency


It’s time to secure user data in your identity system


US Senate subcommittee ponders accountability for AI-assisted scams


AI accountability: Considerations for privacy professionals


Why terms of service should be on your AI governance radar


UK ICO releases Privacy Notice Generator for SMEs


So you want to adopt AI …


ISO standard offers AI Management System template


Big questions for small businesses in the American Privacy Rights Act


A question of identification: Protecting against ‘anonymized’ targeting


Data minimization: An increasingly global concept


Building a privacy layer for AI


Understanding marketing privacy: Overlooked aspects, key questions and practical audits


How to build a ROPA to fit business, privacy needs


Taming the beast: 7 tips for privacy professionals to facilitate responses to DSARs, reduce risk and build trust


Building a modern data protection technology stack


Five compliance best practices for a successful AI governance program


Evaluating the use of AI in privacy program operations


Rethinking the role of CPOs: Prioritizing operationalizing privacy controls over legal expertise


Building effective AI through collaboration


From overlooked to optimized: Revolutionizing data-retention practices


A view from DC: Can there be accountability for web scrapers?


Spilling the tea on AI accountability: An analysis of NTIA stakeholder comments


Managing downstream risks of ‘do not sell’ fulfillment


The definition of ‘anonymization’ is changing in the EU: Here’s what that means


The latest dimension of the global race for an AI governance framework


Launching an AI governance program? Start with your ‘why’


Top issues to address when using automated employment decision-making tools


Unlawful data processing claims: An insurance perspective


New options for anonymization ahead?


Shifting to first-party data: Privacy pitfalls around consent and transparency


A new standard for anonymization


Redefining data mapping


How machine learning can help small businesses deal with data privacy compliance


Privacy: An organization’s responsibility for building trustworthy systems


Running a privacy law-compliant inclusion and diversity data collection program globally


Assessing risk: Determining the appropriate risk flags for your privacy risk assessments


US House subcommittee talks proposed surveillance ad ban, Big Tech accountability


Ransomware: 5 critical tips for organizations


2023 here we come: How to prepare your privacy program


Measuring global diversity and inclusion: The art of the possible


10 recommendations for regulating non-identifiable data


Data privacy requests metrics: Lessons for your privacy program


What are the driving forces of a company’s privacy strategy in a constantly changing landscape?


Tech vendor looks to fill market gap by targeting SMEs


BBB National Programs first APEC-approved US nonprofit Accountability Agent


Effective management of cannabis consumer data risk


Dynamic data security should be the policy default: Dynamic data obscurity revisited


Privacy fatigue and how to combat it


Why demonstrable accountability matters


Why Batman shouldn’t write your privacy notice


Anti-discriminatory algorithmic accountability: Transparency by design in AI-powered decision making


From Microsoft’s CPO to Airbnb’s, his goals are the same


Calif. on the verge of instituting new deidentification requirements, broader research exemptions


3 benefits for businesses to adopt PDS


Beyond a compliance mindset: How we communicate about privacy impacts our influence


Building a culture of privacy: Privacy as a strategic initiative


Study finds 93% of US citizens would switch to privacy-conscious organizations


Setting data retention timelines


CIPL report explores ‘the age of accountability’


Building a culture of privacy: Be customer-centric


How to make responsibly sourced data the rule, not the exception


Deidentification 201: A lawyer’s guide to pseudonymization and anonymization


Embedding data ethics into your ‘culture of privacy’


How to operationalize privacy by design


How to leverage your existing privacy program to manage brand reputation risks


Building a culture of privacy: Legal compliance as a result, not a goal


Program aims to help organizations design better privacy notices


Looking beyond the fines: Accountability in light of FTC consent orders


Building a long-lasting privacy program in an ever-changing regulatory landscape


How to manage insider threats without violating privacy laws


Tool helps map out relevant privacy laws for organizations


Deidentification versus anonymization


APEC announces new US Accountability Agent for CBPR certifications


A look at the proposed Algorithmic Accountability Act of 2019


How do organizations demonstrate a positive privacy impact?


Does anonymization or de-identification require consent under the GDPR?


Under Armour takes ‘honorable mention’ for building innovative privacy program


How to draft a GDPR-compliant retention policy


How to drive effective privacy operations with functional requirements


The role of DPAs in incentivizing accountability


UX solution allows companies to create streamlined privacy notices


Encouraging a self-resolution approach under the accountability principle


Starting-up privacy: How to facilitate privacy in smaller companies


Looking at how our small business uses data: A GDPR perspective


A lean approach to compliance: Minimum viable privacy program


De-identification: Moving from the binary to a spectrum


How startups can beat breaches on a budget


A de-identification protocol for open data


On Building Consumer-Friendly Privacy Notices for the IoT


For Privacy Officers: Getting to Accountability with Limited Resources


Need To Write a Solid Privacy Notice? A Few Tips


Best practices in drafting plain-language and layered privacy policies


Five considerations before publicizing privacy policy updates


View More


Research Articles and Reports

View all Research Articles and Reports

Compliance technology adoption: Navigating and overcoming challenges


AI Governance Profession Report 2025


US Data Privacy Litigation: Litigating accountability through shareholder action


Benchmarking salary for digital responsibility


US Data Privacy Litigation: Security breach litigation


Top 10 operational impacts of the EU AI Act


Privacy Governance Report 2024


Organizational Digital Governance Report


Top 10 operational impacts of India’s DPDPA


Responsible AI Management: Evolving Practice, Growing Value


Amending Australia’s Privacy Act: Small businesses, bigger responsibilities


IAPP-EY Professionalizing Organizational AI Governance Report


Implications of the AI executive order for business


Privacy governance: A problem solved or an ongoing challenge?


Privacy Risk Study 2023


A trans-Atlantic comparison of a real struggle: Anonymized, deidentified or aggregated?


Privacy and AI Governance Report


The Alignment Problem with “Sale of Data”


Maximize your minimization and other takeaways from the FTC’s Drizly case


Top 5 Operational Impacts of China’s PIPL


Privacy in M&A transactions: The playbook


Privacy as a competitive differentiator: Building an effective and strategic healthcare privacy program


Vaccine credential systems: Considerations for US employers


Ransomware, data protection and compliance


Top 10 operational impacts of the CPRA


Privacy in the Wake of COVID-19


Privacy Leaders’ Views – The Impact of COVID-19 on Privacy Priorities, Practices and Programs


Top 5 operational impacts of Brazil’s LGPD


Benefits, Attributes and Habits of Mature Privacy and Data Protection Programs


The State of Data Rights


The Skill Set Technologists Need to Implement a Privacy Risk Management Framework


How to Build a Culture of Privacy


Measuring Privacy Operations


How Privacy Tech Is Bought and Deployed


CCPA offers minimal advantages for deidentification, pseudonymization, and aggregation


Top 5 Operational Impacts of the California Consumer Privacy Act


Applying the Positive-Sum Principle for Successful Privacy by Design Outcomes


6 Ways Privacy Awareness Training Will Transform Your Staff


Must-Have Privacy Training Features for Your Team


Privacy and Data Security is for Everyone


They Did What? Top Privacy Mistakes To Watch Out For (and How To Avoid Them)


Outsourcing your DPO


Top 10 operational responses to the GDPR


How Privacy Awareness Builds Trust


Getting to GDPR Compliance: Risk Evaluation and Strategies for Mitigation


On Monetizing Personal Information


Check or Mate? Strategic Privacy by Design


Benchmarking your Privacy Incident Management Program


The General Data Protection Regulation Matchup Series


How to Shop Smart for Cyberinsurance


Assessing Mobile App Data Privacy Risk


Incident Response series


Getting to the ROI of Privacy


The Ransomware Epidemic


Building a Program that Provides Value


For a Successful Privacy Program, Use these Three A’s


How the C-Suite Should Talk About Cybersecurity


Starting up privacy at a start-up


How IT and Infosec Value Privacy


The Top 10 Operational Impacts of the EU’s General Data Protection Regulation


Monitoring Your Privacy Program


Third-Party Vendor Management Means Managing Your Own Risk


Privacy, Security and Practical Considerations for Developing or Enhancing a BYOD Program


Managing Your Data Breach


Ten Steps to a Quality Privacy Program


Privacy Policies: How To Communicate Effectively with Consumers


View More


Podcasts, Videos, Web Conferences

View all: Podcasts, Videos, Web Conferences

New EU Mandate: What it means for your digital governance program


Privacy for risk management: Bridge the business, technology and compliance gaps


Meta’s risk evolution: automating privacy reviews for integrated digital governance


The impact of AI on companies of all sizes (AIGG Europe 2025)


The real-world work and right-now experience around AI governance in matters related to children (AIGG Europe 2025)


The strategic privacy pro: How to be a partner, not a blocker


The privacy gym: Get your data in shape!


The reluctant privacy pro: Shortcuts and tips for marketing, security, IT & more


A discussion with NYC CPO Michael Fitzpatrick


A blueprint for efficient SRRs: Mastering your subject rights workflow


Sleeping giant of privacy, security and e-discovery data deletion


Discovering the ROI of privacy automation


Getting bang for your buck: Spending your 2025 privacy budget wisely


Data deletion ‘Jeopardy’: Minimizing risk in a data-driven world


Privacy pros: Why collaborate with sales and marketing and how to do it well


AI red teaming strategy and risk assessments: A conversation with Brenda Leong


Unlock privacy ROI: Why making cross-functional allies is key


30 countries, 200+ domains, one end goal: Managing privacy compliance at scale


Data governance approaches to mitigating AI risk


Automated decision-making: Navigating your compliance obligations


Why privacy is your secret weapon against third-party risk


Organizational Digital Responsibility in Practice


Implementing AI governance in a global compliance environment


Future-proofing consent: Effective compliance in a changing landscape


Navigating the regulation jungle: Be compliant, work efficiently and stay sane


The cost of noncompliance: More than just fines


Securing buy-in: Making the business case for data privacy


Building the case: Get buy-in to minimize data across your organization


Beyond setup: Key steps to continuous compliance in consent management


Building an AI governance and compliance program


Bringing your AI policy to life: Operationalizing key strategies for governance


Universal consent: Building beyond cookie consent


Auditing consent: Essential strategies for improving consent compliance in 2024


Best practices for building and enforcing global retention schedules


3 steps to elevating your third-party risk management process


Mastering the art of AI governance to unlock generative AI innovation


Data Privacy Day: How privacy champions can build a privacy-centric culture


Prioritizing privacy to bolster trust in innovation


Foundations for an effective AI governance program


Privacy by design to evolve beyond compliance & enforce responsible use of data


Managing privacy in the era of generative AI


The building blocks for managing privacy risks at Square Enix


Getting companies to embrace a holistic data strategy (IAPP Global Privacy Summit 2023)


Changing Privacy and Stakeholder Management for a Cloud-First World


Weathering the storm: Building an effective privacy budget & proving ROI in 2023


State AGs and Privacy in 2023: What Your Business Needs to Know


Leveraging privacy governance for the responsible use of AI


Five ways to build a bulletproof PBD program with your security partners


Taking your EU GDPR program across the pond


Privacy by Code: Filling the Gap in Your Privacy Programs


What Your Business Should Be Doing Now to Unlock Privacy Benefits


Data Lifecycle: The Privacy Path Less Chosen


Next Gen Privacy: Breathing life into your legacy inventory process


How to future-proof your privacy program


Automated Data Mapping That Charts the Course for Privacy and Beyond


Three Ways Privacy and Security Can Crush Third-Party Reviews – as Friends


Perfecting Privacy Practices


Privacy Metrics to Uplevel Your Privacy Program


Consumer Perspectives on Data Privacy and Implications for Business Growth


Managing Privacy Risk and Safeguarding Personal Information


The Importance of Diversity in the Privacy Office: A U.S. Perspective


Data Retention: The Blind Spot in Your Privacy Program


How To Build An Effective Privacy Engineering Team


Marketing and Consumer Experience Perspectives to Enhance Your Privacy Program


Practical Tips for Building Your Privacy Operations


Establishing Repeatable and Scalable Privacy Programs


A Practitioner Approach to Implementing Data Protection & Privacy by Design


From Programs to Programmatic: New Mindsets & Methods for Privacy Challenges


Why Privacy Departments Hold the Key to Incident Response


Rethinking notice and consent: A chat with Jen King


Building a Resilient Privacy Program and Operation


Building a Next Generation Practice Leadership


Privacy Metrics: Measuring Privacy Programs


Privacy KPIs: Showing the Business Your Privacy Management is Effective


The 7 Sins of Managing Data Privacy


D&I and Your Privacy Program: A Discussion on Intersectionality


A 360-Degree View of Enterprise-wide Privacy Risk


Privacy Compliance Meets IT


Privacy Program Remediation to Incorporate Legacy Systems


Building a Privacy Culture: A Conversation with Privacy Program Managers


Building a Privacy Culture in Our Conflicted Age


Practical Primer on Privacy Preparedness


Strategic Vendor Risk Management for Privacy Pros


Building a Privacy Program from Ground Zero


View More


Back to Top