Is Your Privacy Policy Current? What You Don't Know Can Hurt Your Business

Privacy law in the U.S. is rapidly changing. Right now, 12 states have comprehensive privacy laws on their books and six more will soon join their ranks—and every state requires that companies publicly post their privacy policies. Many companies struggle to shore up their privacy practices and bring them into compliance. Below, we make this effort less overwhelming by breaking it down into a series of manageable steps.

Step 1: Review Your Privacy Policy

The easiest thing to do right away is look at your privacy policy’s version date. If more than six months have passed since it was updated, you have updates to make. (If you do not see a version date, assume it needs updating.)

Next, consider whether you should complete this update internally or need to outsource. Internal business leaders and other resources are no doubt best positioned to lead these efforts. When engaged early, effective outside counsel can add value and help minimize risk by (1) ensuring everything is appropriately covered, (2) providing key insights into what similarly situated companies are doing, and (3) issue-spotting based on the current litigation landscape.

Step 2: Conduct a Privacy Impact Assessment (PIA)

Once the privacy policy update process is complete or underway, we recommend running a privacy impact assessment (PIA). This is a process for assessing and ensuring compliance with applicable legal, regulatory, and internal policy privacy requirements. At a high level, a PIA will help you promptly identify risks in your privacy practices and evaluate possible mitigation measures before an urgent need to do so arises.

Step 3: Develop a Cadence for Repeating Steps 1 and 2

Complying with privacy laws in the U.S. requires an ongoing commitment. Setting up a process to routinely and periodically review and update your privacy policies and procedures is not just a good idea, but increasingly legally required.

We Can Help

Maslon can help your company update its privacy policy and related procedures and conduct a PIA to ensure you remain compliant.