Operate Maryland MODPA controller duties including security + processor contracts + Data Protection Assessment (DPA). Controllers must establish reasonable administrative + technical + physical security practices appropriate to volume and nature of personal data + nature of processing + state-of-the-art. Processor Contracts (Section 14-4608) must include: clear instructions for processing + nature and purpose + type of data + duration + rights and obligations of both parties + processor must (a) ensure confidentiality obligations on persons processing; (b) at controller direction delete or return all personal data at end of provision unless retention required by law; (c) make available to controller all information necessary to demonstrate compliance + cooperate with assessments by controller; (d) engage subprocessors only after providing opportunity to controller to object + flow down same obligations; (e) implement appropriate technical and organisational measures. Data Protection Assessment (Section 14-4609) MANDATORY for: (a) processing for purpose of targeted advertising; (b) sale of personal data; (c) processing for profiling presenting reasonably foreseeable risk of unfair or deceptive treatment + financial physical reputational injury + intrusion + injury; (d) processing of sensitive data; (e) processing presenting heightened risk of harm to consumers including processing for training AI/ML systems. Available to Attorney General upon request. Single assessment may cover comparable processing activities.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 289 controls across 80 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
MY-PDPA-DPO-Designation-Class-Data-User-Registration-DPIA-Code-Practice-Section-43A-2024-Amendment Malaysia PDPA Governance + DPO Section 43A + Class of Data User Registration + DPIA + Code of Practice
MY-PDPA-Data-Subject-Rights-Access-Correction-Portability-Withdraw-Consent-Prevent-Marketing-Sections-30-43 Malaysia PDPA Subject Rights + Access + Correction + Portability + Withdraw Consent + Prevent Marketing + Sections 30 to 43
MY-PDPA-Security-Principle-Retention-Data-Integrity-Breach-Notification-72-Hour-Section-12B-2024-Amendment Malaysia PDPA Security + Retention + Data Integrity + Breach Notification 72 Hour + Section 12B + 2024 Amendment
MY-PDPA-Seven-Personal-Data-Protection-Principles-General-Notice-Choice-Disclosure-Security-Retention-Data-Integrity-Access Malaysia PDPA Seven Principles + General + Notice and Choice + Disclosure + Security + Retention + Data Integrity + Access
PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33
PIPA-Cross-Border-Transfer-Articles-28-8-28-9-Adequacy-Standard-Contract-Certification-EU Korea PIPA Cross-Border Transfer + Articles 28-8 + 28-9 + Adequacy + EU 2021
PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37
PIPA-Sensitive-Information-Unique-ID-Resident-Registration-Numbers-CCTV-Articles-23-24-25 Korea PIPA Sensitive Information + Unique ID + RRN + CCTV + Articles 23-25