Starting – Collecting The Information You Need
Here are the information pieces I recommend you have before you start, in no particular order:
- Understand the industry you are in. If you are in a particularly regulated industry, there are some extras that you need to pay attention to. These industries generally include:
- Financial Services (and in particular, customer oriented businesses)
- Healthcare (and in particular, patient care)
- Education (and especially private education, as contrasted with state-sponsored)
- Providing legal advice to legal professionals (for obvious reasons )
- Know where you are.
This might seem obvious, however, in the Internet era, there seems to be a lack of emphasis on geo-political boundries. That, however, does not work. You need to know what laws your local jurisdiction has regarding privacy. You can use my pages at International or USA Privacy Laws,
www.arielsilverstone.com/privacyRas references, but do not use those and those alone. Laws change rapidly and I am not an attorney. For example, some jurisdictions have no privacy rules at all. Other jurisdictions have…well, yes… hundreds.
- Figure out your intended reach.
Generally, if your intended audience is in Europe, versus for example, the United States, different rules may apply. If you want to do business in France, this entire guide is not for you – give me a call instead.
Likewise, if your targeted audience is minors, or if it is a historically protected minority, there are special considerations that you must adhere to.
- Is the same policy is intended to serve both your internal staff and visitors?
- Analyze what data you need to collect and what you intend to do with it.
I cannot emphasize this point too much: Do NOT collect what you do not need and do not store what you do not need.
- And finally, research what your own organization did, if anything, on this subject before. If you change existing policies you should, and in some cases, must, inform the effected parties.