The three Ps of compliance

The connections between people, processes, and products

“People perform processes to create products” accurately describes any business. Modeling this statement into a framework is where the key to effective governance, regulation, and control (GRC) lies. Below is a logical representation of this framework:

1. People, Processes, and Products are entities. Each instance of an entity is an object. For example:
   • Under People, an HR executive or a developer is an object.
   • Under Processes, an activity (like hiring) or a business function (like product development) is an object.
   • Under Products, an application or infrastructure that your company produces is an object.
2. People (1,n) Processes: Each object under People can be mapped to any number of objects under Processes.
   • One person or department can be involved in many processes. For example, an HR executive may be involved in hiring, onboarding, and grievance management. A marketer may be involved in lead generation as well as public relations.
   • Why is it not “(n,1)”? Although it logically makes sense that more than one person or department may be involved in a process, that approach does not suit compliance. People always drive compliance by taking responsibility for the processes they are involved in. Every person in your organization must be mapped to a process. You may achieve this using the HR portal you use. Every user there must be able to see what processes they are mapped to.
   • If an employee cannot be mapped to a process, they must receive more clarity on their role at the company.
3. Processes (1,1) Products: Each object under Processes must be mapped to only one object under Products. Again, while it’s true that more than one process can be involved in making a product, the concept of a product is more inclusive when it comes to compliance:
   • A product signifies any value that is created out of a process. It includes:
   • The end product or service that customers pay you for.
   • Components like software libraries, inventory of tools, asset registers, and even those crucial spreadsheets. These are products, too, because they are consumed by users within your organization.
   • Every process produces some product that is either sold to customers or used internally in another process, eventually leading to the creation of the end product that your customers pay you for.
   • If a process cannot be mapped to a product—in other words, it doesn’t produce any value—it should not exist.

The list of People, your HR portal, can be mapped to your list of Processes, which is your activity register. Also, your list of Products is the inventory of all value that your organization creates.

When you consolidate controls from certifications like ISO 27001 or a regulation like HIPAA, you can easily map which control corresponds to which entity. This clarity will help you decide how much effort you must put into each area to achieve the desired level of compliance.

Law

The GDPR, HIPAA, and the CCPA are laws that dictate how companies should process personal data. Any regulation stands on top of four pillars:

Principles: These are the values that the governing bodies want you to keep in mind and apply throughout your processes. In the GDPR, Chapter 2 (Art. 5-11) is entirely dedicated to the principles that must be followed while processing personal data.

• Lawfulness, fairness, and transparency: The GDPR gives you six lawful bases, and any processing (collection, usage, disclosure, and storage) must fall under one of those laws.
• Purpose limitation: You must collect and use the data for the stated purpose alone and only collect data for as long as necessary to complete that purpose.
• Data minimization: You must ensure that the personal data you process is adequate and relevant to what is necessary concerning your processing purpose.
• Accuracy: You must take every reasonable step to update or remove data that is inaccurate or incomplete.
• Storage limitation: You must delete personal data when you no longer need it.
• Integrity and confidentiality: You must keep personal data safe and protected against unauthorized or unlawful processing, as well as accidental loss, destruction, or damage, using appropriate technical or organizational measures.

Likewise, Brazil’s Lei Geral de Proteção de Dados (LGPD) lists 10 principles that should be taken into account when processing personal data, such as purpose limitation, necessity, transparency, security, non-discrimination, and accountability.

Principles come into play when you draft policies to govern your processes.

Rules: These usually describe what happens when you do not comply with the law, or they are the standing instructions when you comply with it. For example, Art. 83 of the GDPR describes how much organizations will be fined based on the kind and severity of the breach they face. Rules also describe the actions that you need to take to ensure that principles are implemented.

Likewise, Section 1798.155(a) of Title 1.81.5 in the CCPA describes the penalty for violating the act. Other rules describe how to respond to breaches and how to inform data subjects.

Rules come into play when you draft and standardize procedures for your processes.

Rights and responsibilities: Chapter 3 of the GDPR lays down the rights that data subjects have, and Chapter 4 describes the responsibilities organizations have when they assume the role of controller or processor.

Both rights and responsibilities affect your organization’s processing activities.

For example, the “right to be forgotten” in the GDPR will change the way you process data. You will realize that you can no longer send multiple support emails distributed in multiple inboxes. A consolidated help desk system can ensure that all data corresponding to a support ticket is in one spot so when the right to be forgotten is invoked, all you have to do is focus on the help desk rather than multiple individual inboxes.