Privacy Notices & Transparency
People have a right to know how their data is used. Based on the RoPA, this workshop identifies every point where data is collected and prepares clear privacy notices for each group of data subjects.
Workshop 4 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Identify collection points
List where data is collected: website, forms, cookies, apps, contracts, job applications, intranet, video surveillance, visitor logs and events.
In ResGuard: Data Inventory -
2. Define notice content
Include the controller's identity and contact details, purposes, recipients, transfers, retention periods and how to exercise rights. Most of it comes straight from the RoPA.
-
3. Draft & approve notices
Write one notice per group of data subjects in plain language, using a layered approach: a short summary at the collection point and the full notice behind a link.
In ResGuard: Policy Framework -
4. Publish & keep current
Publish each notice at its collection point, keep previous versions and update notices whenever a RoPA activity changes.
In ResGuard: Policy Framework -
5. Workshop review & close-out
Review the published notices with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- Law No. 29733 sets out the data subject's right to information: the notice must be provided before the data is collected.
- The ANPDP has published a model information clause that works as a starting point.
- For video surveillance, put up visible information signs in line with the ANPDP directive.
Expected result
- Complete inventory of collection points
- Notices for clients, website users, employees, applicants and vendors
- Notices approved in the Policy Framework and published
- Update process linked to RoPA changes
ResGuard modules: Policy Framework, Data Inventory (RoPA)