Enterprise Data Governance Policy

Multinational Corporation Data Governance Framework

Document Classification: Internal — Restricted
Version: 3.1
Effective Date: [Current Date]
Review Cycle: Annual (or upon material regulatory change)
Document Owner: Chief Data Officer
Approved By: Executive Leadership Team & Legal Counsel

---

TABLE OF CONTENTS

1. Executive Summary & Policy Purpose
2. Scope and Jurisdictional Applicability
3. Governance Structure & Accountability
4. Data Classification Framework
5. Cross-Border Data Residency Requirements
6. Role-Based Access Control (RBAC) Framework
7. Regulatory Compliance Matrix (GDPR / CCPA / PIPL)
8. Data Subject Rights Management
9. Data Lifecycle Management
10. Incident Response & Breach Notification
11. Vendor and Third-Party Management
12. Enforcement, Sanctions & Review

---

SECTION 1: EXECUTIVE SUMMARY & POLICY PURPOSE

1.1 Purpose

This Enterprise Data Governance Policy ("Policy") establishes the mandatory framework by which [Corporation Name] ("the Corporation") collects, processes, stores, transfers, protects, and disposes of data across all global operations. The Policy is designed to:

• Ensure full legal compliance with applicable data protection regulations across all jurisdictions in which the Corporation operates
• Define clear accountability structures for data stewardship at every organizational level
• Establish consistent, enforceable standards that protect the rights of individuals whose data the Corporation holds
• Minimize organizational risk arising from data breaches, regulatory penalties, and reputational harm
• Enable legitimate business operations while embedding privacy as a fundamental design principle

1.2 Governing Philosophy

The Corporation adopts Privacy by Design and Default as its foundational approach, meaning:

• Data protection is embedded into systems, processes, and products from inception, not added as an afterthought
• The most privacy-protective settings are the default configuration for all systems
• Data processing is limited to what is strictly necessary for defined, legitimate purposes
• Accountability is documented, measurable, and demonstrable to regulators and stakeholders

1.3 Priority Hierarchy

Where conflicts arise between organizational convenience and regulatory compliance, regulatory compliance takes precedence. Where conflicts arise between multiple applicable regulations, the Corporation applies the most protective standard applicable to the data subject, unless doing so would constitute a violation of another jurisdiction's mandatory law, in which case Legal & Compliance shall be consulted immediately.

---

SECTION 2: SCOPE AND JURISDICTIONAL APPLICABILITY

2.1 Entity Scope

This Policy applies universally to:

Entity Type	Applicability
Parent corporation and all wholly-owned subsidiaries	Mandatory, full compliance
Joint ventures in which Corporation holds majority stake	Mandatory, full compliance
Joint ventures in which Corporation holds minority stake	Best-efforts compliance; contractual obligations required
Franchisees and licensees	Contractual data standards required; auditable
All employees, contractors, consultants, temporary workers	Mandatory, as condition of engagement
Third-party vendors and processors	Contractually mandated via Data Processing Agreements

2.2 Data Scope

This Policy governs all data that the Corporation processes, regardless of:

• Format: Digital, physical, audio, video, or biometric
• Storage medium: Cloud, on-premises, hybrid, portable devices, paper
• Origin: Collected directly, obtained from third parties, or generated internally
• Use purpose: Commercial, operational, research, HR, or any other purpose

2.3 Jurisdictional Trigger Matrix

The following table identifies which regulatory regimes apply based on data subject location, data processing location, and the Corporation's business activities:

Regulatory Regime	Primary Trigger	Secondary Trigger	Key Territorial Reach
GDPR	Data subject located in EU/EEA at time of collection	Corporation offers goods/services to EU residents OR monitors behavior of EU residents	Extraterritorial — applies to any processor worldwide
UK GDPR	Data subject located in United Kingdom	Same as EU GDPR	Extraterritorial
CCPA/CPRA	Consumer is a California resident	Corporation meets revenue/data volume thresholds*	California-based consumers only
PIPL	Data subject is a natural person in China	Corporation handles personal information of persons in China OR provides products/services to persons in China	Extraterritorial for overseas processors
LGPD (Brazil)	Data subject located in Brazil	Data collected in Brazil or offered to Brazilian residents	Extraterritorial

*CCPA thresholds: Annual gross revenue >$25M; OR buys/sells/receives/shares personal information of ≥100,000 consumers or households annually; OR derives ≥50% of annual revenue from selling personal information.

2.4 Concurrent Jurisdiction

When a single data processing activity triggers multiple regulatory regimes simultaneously (a common occurrence for multinational operations), the Concurrent Jurisdiction Protocol applies:

1. Identify all applicable regulations using the trigger matrix above
2. Map each regulation's requirements against the planned processing activity
3. Apply the most restrictive applicable standard for each specific requirement (consent, retention, transfer, access rights)
4. Document the analysis and retain for regulatory inspection
5. Where genuine conflicts exist between regulations (e.g., PIPL data localization vs. GDPR data transfer requirements), escalate immediately to Legal & Compliance for conflict resolution

---

SECTION 3: GOVERNANCE STRUCTURE & ACCOUNTABILITY

3.1 Governance Hierarchy

┌─────────────────────────────────────────────────────────────┐
│              BOARD OF DIRECTORS                              │
│         (Ultimate Accountability — Quarterly Reporting)      │
└─────────────────────┬───────────────────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────────────────┐
│              EXECUTIVE DATA GOVERNANCE COMMITTEE             │
│    CEO | CDO | CTO | CISO | CLO | CFO | Regional Presidents │
│              (Meets Monthly — Policy Approval)               │
└─────────────────────┬───────────────────────────────────────┘
                      │
        ┌─────────────┴──────────────┐
        │                            │
┌───────▼────────┐          ┌────────▼───────────┐
│ Chief Data     │          │ Chief Information   │
│ Officer (CDO)  │          │ Security Officer    │
│ Policy Owner   │          │ (CISO)              │
│ Global DPOs    │          │ Technical Controls  │
└───────┬────────┘          └────────┬────────────┘
        │                            │
┌───────▼────────────────────────────▼────────────┐
│           DATA GOVERNANCE COUNCIL                │
│  Regional Data Stewards + Business Unit Owners  │
│         (Meets Bi-Weekly — Operational)         │
└─────────────────────┬───────────────────────────┘
                      │
┌─────────────────────▼───────────────────────────┐
│           DATA CUSTODIANS                        │
│  IT Teams, Database Administrators, System Owners│
│              (Daily Operations)                  │
└─────────────────────────────────────────────────┘

3.2 Role Definitions and Accountabilities

3.2.1 Board of Directors

Accountabilities:

• Receives quarterly data governance reports from the CDO
• Approves major policy changes and resource allocation for compliance programs
• Bears ultimate fiduciary responsibility for regulatory compliance failures
• Ensures data governance risks are integrated into enterprise risk management

3.2.2 Executive Data Governance Committee (EDGC)

Accountabilities:

• Approves this Policy and all material amendments
• Resolves cross-functional disputes regarding data processing decisions
• Reviews and approves cross-border data transfer mechanisms
• Reviews significant breach incidents and post-incident remediation
• Sets organizational priorities when compliance requirements conflict with business objectives

3.2.3 Chief Data Officer (CDO)

Accountabilities:

• Day-to-day ownership of this Policy and the overall data governance program
• Chairs the Data Governance Council
• Appoints and oversees regional Data Protection Officers
• Maintains the enterprise data inventory and processing register
• Reports to EDGC and Board on program effectiveness metrics
• Serves as primary point of escalation for complex data governance questions

3.2.4 Data Protection Officers (DPOs)

Regional DPO Appointments:

Region	DPO Appointment Basis	Regulatory Requirement
European Union	Mandatory under GDPR Article 37	Processing at large scale or involving special categories
United Kingdom	Mandatory under UK GDPR	Same as EU
China	Mandatory under PIPL Article 52	Processing personal information at large scale
United States	Advisory/Best Practice	No federal mandate; state laws vary
Brazil	Advisory/Best Practice	LGPD recommends but does not mandate

DPO Independence Requirements:

• DPOs shall report directly to the highest management level (CDO / C-Suite)
• DPOs shall not receive instructions regarding the exercise of their tasks
• DPOs shall not be dismissed or penalized for performing their duties
• Contact information for each regional DPO shall be publicly disclosed and registered with relevant supervisory authorities
• DPOs shall not hold roles that create conflicts of interest with their data protection mandate

3.2.5 Business Unit Data Owners

Each business unit that collects or uses personal data shall designate a Data Owner who:

• Maintains authority and accountability for specific datasets within their domain
• Approves access requests for their datasets
• Ensures their team's data processing activities are documented in the Processing Register
• Conducts annual data mapping reviews
• Escalates data incidents within 2 hours of identification

3.2.6 Data Stewards

Data Stewards are operational-level employees responsible for:

• Day-to-day compliance with this Policy within their team
• Maintaining data quality and metadata for assigned datasets
• Processing data subject access requests within their domain
• Training new team members on applicable data handling requirements

3.2.7 All Employees

Every employee has a personal obligation to:

• Complete all mandatory data governance training within required timeframes
• Handle personal data only as authorized by their role permissions
• Report suspected data incidents within 1 hour of discovery
• Not circumvent technical or administrative controls
• Seek guidance before initiating new personal data processing activities

3.3 Data Processing Register (Article 30 Record)

The Corporation maintains a comprehensive, continuously updated Data Processing Register that documents, at minimum:

Field	Required Detail
Processing Activity Name	Descriptive name of the processing activity
Controller/Processor Identity	Legal entity and contact
DPO Contact	Applicable regional DPO
Purpose of Processing	Specific, explicit purpose(s)
Legal Basis	Applicable legal basis per each jurisdiction
Categories of Data Subjects	Who is affected
Categories of Personal Data	What data types are processed
Categories of Recipients	Who receives the data
Third Country Transfers	Destination countries and transfer mechanisms
Retention Periods	Specific timeframes by data category
Technical/Organizational Measures	Security controls summary
Special Category Indicators	Whether Article 9 / sensitive data is involved
Regulatory Regime Flags	Which regulations apply

---

SECTION 4: DATA CLASSIFICATION FRAMEWORK

4.1 Classification Tiers

All organizational data shall be classified into one of five tiers based on sensitivity, regulatory requirements, and potential harm from unauthorized disclosure:

---

TIER 1: PUBLIC DATA

Definition: Information that is intentionally disclosed to the general public or that has no reasonable expectation of confidentiality.

Examples: Published press releases, product brochures, public website content, publicly filed corporate documents

Handling Requirements:

• No special handling required beyond standard organizational quality controls
• May be freely shared externally
• Standard encryption in transit recommended but not mandatory

---

TIER 2: INTERNAL DATA

Definition: Non-sensitive business information intended for internal use, the unauthorized disclosure of which would cause minimal organizational harm.

Examples: Internal policies, general business procedures, non-sensitive project plans, internal directories

Handling Requirements:

• Not for external distribution without authorization
• Encrypted in transit
• Access limited to employees and authorized contractors
• Retain per standard business retention schedules

---

TIER 3: CONFIDENTIAL DATA

Definition: Business-sensitive information, non-special-category personal data, and commercially sensitive data whose unauthorized disclosure could cause significant organizational or individual harm.

Examples: Customer contact information, employee personnel records (non-sensitive), business strategies, financial projections, vendor contracts, non-special-category personal data

Handling Requirements:

• Access limited to those with documented business need
• Encrypted at rest and in transit (minimum AES-256)
• Data-at-rest encryption mandatory for all storage
• Transmitted only over secured channels
• Access logged and monitored
• Cannot be transmitted to personal email accounts
• Printed copies must be secured and shredded when no longer needed

---

TIER 4: RESTRICTED DATA

Definition: Highly sensitive personal data, special categories of personal data, regulated financial data, and proprietary data whose unauthorized disclosure could cause severe harm to individuals or the organization.

Examples:

• Special category personal data (health, genetic, biometric, racial/ethnic origin, political opinions, religious beliefs, sexual orientation)
• Payment card data (PCI DSS regulated)
• Social security numbers and government identifiers
• Authentication credentials
• Criminal records
• Children's data (under 13/16 depending on jurisdiction)
• Trade secrets and core intellectual property

Handling Requirements:

• Access requires explicit Data Owner approval and documented business justification
• Multi-factor authentication required for system access
• Encrypted at rest and in transit with highest available standards
• Logging of all access events, including read access
• Anonymized or pseudonymized wherever technically feasible
• Cannot be stored on portable devices without encryption and MDM enrollment
• Cross-border transfer requires additional legal review beyond standard mechanisms
• Separate DPIA required before any new processing activity
• Enhanced vendor due diligence required for any third-party processing

---

TIER 5: TOP SECRET / REGULATORY MAXIMUM PROTECTION

Definition: Data subject to the highest regulatory protection requirements, whose unauthorized disclosure could cause extreme harm to individuals or constitute a categorical regulatory violation.

Examples:

• Biometric data used for unique identification (PIPL Article 28; GDPR Article 9; CCPA)
• Genetic data
• Data relating to children processed for behavioral targeting
• National security-sensitive data (in relevant jurisdictions)
• Law enforcement records
• Data subject to China's Important Data classification

Handling Requirements:

• All Tier 4 requirements, plus:
• Requires CDO or designated DPO approval for all new processing activities
• Stored only in approved, jurisdiction-specific, data-residency-compliant systems
• Subject to continuous access monitoring with automated anomaly alerts
• Minimum data principle enforced with technical controls — system prevents collection of more data than necessary
• Regular automated scanning for unauthorized instances outside approved repositories
• Annual Tier 5 inventory audit by Internal Audit function
• Destruction must be certified and witnessed

4.2 Classification Responsibilities

Who	What
Data Owners	Assign initial classification to new datasets
Data Stewards	Maintain classification accuracy over time
IT/Engineering	Implement technical controls matching classification tier
Legal/Compliance	Review classification of any data with regulatory implications
All Employees	Apply classification markings; handle data per tier requirements

4.3 Reclassification

Data may be reclassified upward or downward with approval of the Data Owner and documentation in the Processing Register. Downward reclassification (e.g., from Restricted to Confidential) requires Legal & Compliance review when personal data is involved.

---

SECTION 5: CROSS-BORDER DATA RESIDENCY REQUIREMENTS

5.1 Framework Overview

Cross-border data transfers are one of the highest-risk areas of the Corporation's data operations and require rigorous controls. The Corporation operates a Residency-First Architecture in which data is, by default, stored and processed within the jurisdiction of data collection, with transfers occurring only when legally justified and technically secured.

5.2 Jurisdiction-Specific Residency Requirements

5.2.1 European Union / EEA (GDPR Chapter V)

Core Principle: Personal data of EU data subjects may only be transferred outside the EEA where an adequate level of protection is ensured.

Approved Transfer Mechanisms (in order of organizational preference):

Mechanism	Description	Conditions
Adequacy Decision	European Commission has determined the destination country provides adequate protection	Check current EC adequacy list; subject to change
Standard Contractual Clauses (SCCs)	EC-approved contractual terms (2021 version mandatory)	Must conduct Transfer Impact Assessment (TIA); supplement with technical measures if needed
Binding Corporate Rules (BCRs)	Approved intra-group transfer mechanism	Requires supervisory authority approval; Corporation has BCRs approved by [Lead SA]
Approved Codes of Conduct	Where applicable certification exists	Verify current certification status
Derogations (Article 49)	Last resort only	Explicit consent, necessity for contract performance, vital interests, etc. — case-by-case Legal approval required

Transfer Impact Assessments: Required for all SCC-based transfers. Must assess:

1. Legal framework of the destination country
2. Risk that government authorities may access transferred data
3. Whether supplementary technical measures (encryption, pseudonymization) adequately mitigate identified risks
4. Documentation filed with Legal & Compliance before transfer commences

Schrems II Compliance: All US-bound transfers of EU personal data must use current SCCs supplemented by TIA. Where TIA concludes that US law undermines the protection offered by SCCs, additional technical measures (end-to-end encryption with keys held exclusively in the EU) must be implemented or the transfer must be suspended pending legal guidance.

5.2.2 United Kingdom (UK GDPR + Data Protection Act 2018)

Post-Brexit Framework: UK operates an independent data transfer regime. The UK has granted adequacy to the EU/EEA (and vice versa via the EU-UK adequacy decision, valid through June 2025 — monitor for renewal).

Approved Transfer Mechanisms:

• UK International Data Transfer Agreements (IDTAs) — UK equivalent of SCCs
• UK Addendum to EU SCCs — for transfers from UK using EU SCCs
• Binding Corporate Rules approved by the ICO
• UK adequacy regulations (where applicable)

Note: The EU-UK adequacy decision requires annual monitoring. If it lapses or is revoked, a separate transfer mechanism must immediately be in place.

5.2.3 China (PIPL Chapter III)

China's PIPL imposes the most prescriptive cross-border transfer requirements of any major jurisdiction. Strict compliance is mandatory.

Residency Baseline: Personal information of persons in China must be stored within mainland China by default.

Cross-Border Transfer Conditions: Personal information may only be transferred outside China where ONE of the following conditions is met:

Condition	Applicability	Status
Security Assessment by CAC	Mandatory for: (1) Critical Information Infrastructure Operators (CIIOs); (2) processors handling personal information of ≥1 million individuals; (3) cumulative overseas transfers of personal information of ≥100,000 individuals since January 1 of prior year; (4) sensitive personal information of ≥10,000 individuals	Obtain from Cyberspace Administration of China (CAC); valid for 2 years
Standard Contract filed with CAC	For processors below the above thresholds	File Standard Contract (SC) with local CAC within 10 business days of effectiveness; requires Personal Information Protection Impact Assessment (PIPIA)
Personal Information Protection Certification	Certification from CAC-accredited organization	For intra-group transfers; identify applicable certification bodies

Additional PIPL Transfer Requirements:

• Data subject must be informed of the overseas recipient's name, contact details, purpose, method, categories of PI, and data subject rights in the receiving country before transfer
• Separate, specific consent is required for cross-border transfer (standalone consent — cannot be bundled with general processing consent)
• The overseas recipient must ensure a level of protection no lower than PIPL requirements
• Contractual obligations must bind the overseas recipient to equivalent protections
• Technical Requirement: Maintain a China-specific data environment (separate database/system) that can be ring-fenced if transfer mechanisms become unavailable

Important Data: Data classified as "Important Data" under Chinese cybersecurity law (as determined by sectoral regulators) is subject to additional requirements including mandatory security assessments even below the personal information volume thresholds. All business units operating in China must conduct quarterly reviews to identify whether any data they hold may qualify as Important Data under applicable sectoral standards.

Data Localization Architecture Requirements:

• All personal information of Chinese data subjects collected within China shall be stored in data centers located in mainland China
• No exceptions exist for operational convenience
• Backup and disaster recovery systems for China-sourced data must also be located in mainland China
• Access to China-stored data by personnel located outside China must be conducted via approved remote access mechanisms with audit logging and, where transfer thresholds are met, under an operative CAC-approved mechanism

5.2.4 California (CCPA / CPRA)

CCPA/CPRA does not impose geographic data residency requirements analogous to GDPR or PIPL. However:

• Sale/Sharing Restrictions: Personal information of California consumers may not be "sold" or "shared" (for cross-context behavioral advertising) without providing an opt-out right that is honored before transfer
• Service Provider Constraints: Transfers to service providers must be governed by contracts prohibiting the service provider from retaining, using, or disclosing personal information outside the service relationship
• Sensitive Personal Information: Enhanced protections apply to sensitive PI (government IDs, financial account numbers, precise geolocation, health information, sexual orientation, etc.) — consumers must be offered the right to limit use and disclosure
• Opt-Out of Sale: The "Do Not Sell or Share My Personal Information" link must be prominently displayed; opt-out signals (GPC — Global Privacy Control) must be honored within 15 business days

5.2.5 Brazil (LGPD)

• Cross-border transfers of personal data are permitted to countries with adequate protection recognized by Brazil's National Data Protection Authority (ANPD) or through specific contractual clauses approved by ANPD
• Standard contractual clauses issued by ANPD must be used for transfers to non-adequate countries
• Monitor ANPD adequacy list, currently being developed

5.3 Cross-Border Transfer Decision Tree

Before any cross-border transfer of personal data is initiated, the responsible Data Steward must complete the Cross-Border Transfer Authorization Process:

Step 1: Identify all nationalities/residencies of data subjects in the dataset
        ↓
Step 2: For each jurisdiction, apply the transfer mechanism matrix above
        ↓
Step 3: Determine whether existing transfer mechanisms cover this transfer
    → YES: Document the applicable mechanism and proceed
    → NO: STOP — escalate to Legal & Compliance before any transfer
        ↓
Step 4: Conduct required risk assessment (TIA for GDPR; PIPIA for PIPL)
        ↓
Step 5: Implement required technical safeguards
        ↓
Step 6: Register the transfer in the Processing Register
        ↓
Step 7: Set calendar reminder for mechanism renewal/review dates

5.4 Data Localization Architecture Standards

5.4.1 Required Regional Data Environments

Data Region	Scope	Required Technical Controls
EU/EEA Zone	Personal data of EU/EEA data subjects	Data centers in EU/EEA member states; encryption keys held in EU; no persistent copy outside EU without transfer mechanism
China Zone	Personal data of persons in China	Data centers in mainland China; separate network segment; access from outside China logged and governed by CAC mechanism; no replication outside China without CAC authorization
US Zone	US consumer personal data	Data centers in US; CCPA-compliant access controls; separate handling for California consumers
UK Zone	Personal data of UK data subjects	May share infrastructure with EU Zone but must be segregable; governed by UK GDPR
Global Zone	Non-personal data, anonymized data, Tier 1-2 data	Standard global infrastructure

5.4.2 Infrastructure Requirements

• Cloud Provider Standards: All approved cloud providers must be able to demonstrate geographic data isolation at the storage layer, not merely at the logical layer
• Encryption Key Management: Encryption keys for Tier 3–5 data in regulated zones must be held within the same geographic zone; encryption must be applied before data leaves its home zone
• Data Egress Monitoring: Automated monitoring tools must be deployed to detect and alert on data egress from regulated zones without an associated authorized transfer record
• Zone Integrity Testing: Quarterly tests must validate that data does not flow between zones without authorized mechanisms

---

SECTION 6: ROLE-BASED ACCESS CONTROL (RBAC) FRAMEWORK

6.1 RBAC Principles

The Corporation's access control model is built on four foundational principles:

1. Least Privilege: Users are granted the minimum access necessary to perform their specific job functions, and no more
2. Need to Know: Access to personal data requires a documented, legitimate business need — access is not granted based on organizational seniority alone
3. Segregation of Duties: Critical data operations require more than one authorized individual; no single person should have unchecked access to sensitive personal data and the controls that govern it
4. Zero Trust Architecture: Access is never trusted implicitly based on network location; continuous verification is required

6.2 RBAC Role Taxonomy

Standard Corporate Roles

RBAC Role	Description	Typical Job Functions
Data Owner	Authorizes access to specific data domains; approves exceptions	VP/Director level data domain heads
Data Steward	Manages data quality and access within authorized scope	Data managers, analytics leads
Data Consumer — Standard	Read-only access to approved, aggregated, or anonymized data	Analysts, reporting users
Data Consumer — Elevated	Read access to individual-level personal data within approved scope	Customer service, HR business partners
Data Processor — Standard	Read/Write access for operational processing	Application users, CRM users
Data Processor — Elevated	Read/Write/Delete for operational purposes	Database operators, data engineers
System Administrator	Technical administration without data content access (where feasible)	IT infrastructure team
Security Administrator	Manages access controls; cannot also be a data processor	Information security team
DPO/Compliance	Read-only audit access to all systems for compliance monitoring	DPO, Internal Audit, Legal
Emergency Access	Break-glass access for critical incidents; time-limited; fully logged	On-call engineers with authorization

Restricted/Special Roles

RBAC Role	Applicable Data	Additional Requirements
Tier 4 Processor	Restricted/special category personal data	Written Data Owner approval; annual recertification; mandatory training completion
China Data Processor	Personal data of Chinese data subjects stored in China zone	PIPL training certification; explicitly named in PIPIA documentation
Children's Data Processor	Personal data of minors	Enhanced background check; specialized training; DPO approval
Cross-Border Transfer Agent	Personal data authorized for cross-border transfer	Legal-approved transfer mechanism documentation; transfer logging

6.3 Access Request and Provisioning Process

Employee/Contractor submits Access Request via IAM system
    ↓
Line Manager reviews and approves business justification
    ↓
Data Owner approves access to specific data domain
    ↓ (for Tier 4+ data)
DPO reviews for compliance implications
    ↓
IT Security validates technical feasibility and applies controls
    ↓
Access provisioned with:
    - Defined scope (specific systems/datasets only)
    - Defined duration (maximum 12 months; recertification required)
    - Logging enabled
    - MFA enforced
    ↓
Automated reminder to Data Owner at 30 days before expiry
    ↓
Data Owner recertifies or access is automatically revoked

Response Timeframes:

• Standard access requests: 5 business days
• Elevated/Tier 4 access requests: 10 business days
• Emergency access: 4 hours (retroactive full documentation required within 24 hours)

6.4 Authentication Standards

Data Tier	Authentication Requirement
Tier 1-2	Single factor (corporate SSO)
Tier 3	Multi-factor authentication (MFA) — time-based OTP or hardware token
Tier 4-5	MFA mandatory + privileged access workstation (PAW) for administrative access
China Zone	MFA + Chinese jurisdiction-compliant authentication methods
Remote access to any personal data	MFA always required regardless of tier
Emergency/Break-glass access	MFA + dual authorization (two senior approvers) + automatic full session recording

6.5 Access Reviews and Recertification

Review Type	Frequency	Responsible Party	Action if Not Recertified
Standard Access Recertification	Annual	Data Owner	Automatic revocation
Elevated/Tier 4 Access Recertification	Semi-annual	Data Owner + DPO	Automatic revocation
Privileged Access Review	Quarterly	IT Security + CISO	Automatic revocation
Contractor/Third-Party Access Review	Quarterly	IT Security + Vendor Manager	Automatic revocation
Terminated Employee Access	Immediately upon HR notification	IT (automated)	Revoked within 1 hour
Role Change Access Review	Upon any role change	Line Manager + IT	Prior access revoked; new access requested from scratch
Anomaly-Triggered Review	As detected by SIEM	IT Security	Immediate suspension pending review

6.6 Technical RBAC Implementation Requirements

• All personal data systems must support role-based access control at the field/column level for Tier 4-5 data (not merely at the table or system level)
• Database views and API-level controls must enforce data minimization (users see only the data fields their role requires)
• All access to personal data must generate an immutable audit log entry containing: user ID, timestamp, system, data accessed/modified, and action taken
• Audit logs must be retained for a minimum of 3 years and protected from modification or deletion by any single user
• Segregation: Audit log administrators must not be the same individuals as those whose access is being logged
• Privileged access management (PAM) tools must govern all administrative access to databases containing personal data
• Just-in-time (JIT) access provisioning preferred for Tier 4-5 data — access granted for defined session only, not persistent

6.7 Special Situations

6.7.1 Cross-Jurisdictional Access

When employees in one jurisdiction need to access personal data stored in another jurisdiction:

• The access must be authorized under an operative cross-border transfer mechanism
• The applicable mechanism must be documented in the access provisioning record
• Access must be logged with jurisdiction-of-access metadata
• For China Zone: All access by non-China-based personnel is treated as a cross-border transfer and governed accordingly

6.7.2 Aggregated and Anonymized Data

Where data has been properly anonymized (meeting the standard that re-identification risk is negligible), RBAC requirements are reduced to standard confidentiality controls. However:

• Anonymization must be validated by a qualified data scientist/engineer
• The anonymization method must be documented and approved by the DPO
• Tier 4-5 source data used to generate anonymized outputs remains subject to full Tier 4-5 controls

---

SECTION 7: REGULATORY COMPLIANCE MATRIX

7.1 Comprehensive Comparison: GDPR / CCPA / PIPL

The following matrix provides a side-by-side comparison of key requirements and the Corporation's implementation standard (which applies the most protective approach):

---

7.1.1 Legal Basis for Processing

Requirement Element	GDPR	CCPA/CPRA	PIPL	Corporation Standard
Legal bases available	6 bases: consent, contract, legal obligation, vital interests, public task, legitimate interests	No equivalent "legal basis" system; relies on disclosure + opt-out rights	7 bases: individual consent, contract/HR, legal obligation, public health emergency, public interest/news, self-disclosed PI, other laws	Identify applicable legal basis under each applicable regime before processing; document in Register
Consent validity	Freely given, specific, informed, unambiguous; no pre-ticked boxes; easily withdrawn	Opt-out model (not opt-in) for most PI; opt-in for sensitive PI and minors under 16	Voluntary, express, fully informed; separate consent required for each distinct purpose; withdrawal right	Use opt-in consent as global standard for marketing and non-essential processing; honor opt-out immediately
Legitimate interests	Available for many commercial purposes; requires balancing test (LIA)	Not applicable	Not available as a general basis	Only use legitimate interests where genuinely applicable under GDPR; never rely on it as a substitute for proper consent in China or for CCPA-covered activities
Children's data	Age of

Disclaimer: This document serves as a comprehensive template for an Enterprise Data Governance Policy. It is intended for informational and strategic planning purposes only. It does not constitute legal advice. Multinational corporations must engage qualified legal counsel in each relevant jurisdiction (EU, USA, China, etc.) to validate specific compliance mechanisms, as regulations are subject to change and interpretation.

---

ENTERPRISE DATA GOVERNANCE AND PRIVACY POLICY

Document Control

Policy Owner	Chief Data Officer (CDO) / Chief Privacy Officer (CPO)
Version	1.0
Effective Date	[Date]
Review Cycle	Annual or upon Regulatory Change
Classification	Internal / Confidential
Applicability	Global (All Entities, Employees, Contractors, Systems)

---

1. PURPOSE AND OBJECTIVE

The purpose of this Policy is to establish the framework for managing [Company Name]'s data assets as a strategic resource while ensuring strict adherence to global privacy regulations. This Policy mandates the protection of Personal Data, defines data residency requirements, enforces Role-Based Access Controls (RBAC), and ensures simultaneous compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the People's Republic of China Personal Information Protection Law (PIPL).

2. SCOPE

This Policy applies to:

1. All Entities: All subsidiaries, branches, and affiliates of [Company Name] globally.
2. All Personnel: Employees, contractors, consultants, and third-party processors.
3. All Data: All Personal Data and Sensitive Personal Data processed, stored, or transmitted by [Company Name], regardless of format (digital, physical, cloud).
4. All Systems: Information systems, applications, and databases used to process data.

3. DEFINITIONS

• Personal Data (PD): Any information relating to an identified or identifiable natural person (GDPR "Personal Data", CCPA "Personal Information", PIPL "Personal Information").
• Sensitive Personal Data: Data revealing racial/ethnic origin, political opinions, religious beliefs, health data, biometric data, financial account info, or precise geolocation.
• Data Controller: The entity that determines the purposes and means of processing (usually [Company Name] Entity).
• Data Processor: A third party or entity that processes data on behalf of the Controller.
• Cross-Border Transfer: Any transmission of data from the jurisdiction of collection to a server or entity located in a different country.
• RBAC: Role-Based Access Control, a method of restricting network access based on the roles of individual users.

4. GOVERNANCE STRUCTURE AND ROLES

To manage conflicting regulatory requirements, [Company Name] adopts a Federated Governance Model.

4.1. Global Data Governance Council (GDGC)

• Responsibility: Sets global standards, approves data classification, and resolves cross-jurisdictional conflicts.
• Composition: CDO, CPO, CISO, General Counsel, Regional Privacy Leads.

4.2. Regional Privacy Leads (RPL)

• Responsibility: Ensures local compliance (e.g., EU DPO, China Representative). They have veto power on data transfers originating from their region if local law is violated.
• Requirement: PIPL requires a dedicated person/organization responsible for personal information protection within China.

4.3. Data Owners

• Responsibility: Business leaders accountable for specific data domains (e.g., HR Data Owner, Customer Data Owner). They approve access requests.

4.4. Data Stewards

• Responsibility: Ensure data quality, classification, and lifecycle management within their domain.

---

5. DATA CLASSIFICATION AND RESIDENCY

Compliance with residency laws (particularly PIPL and GDPR) requires strict data mapping and localization.

5.1. Data Classification Tiers

All data must be tagged at the point of collection:

1. Public: No restrictions.
2. Internal: For employee use only.
3. Confidential: Business sensitive (IP, Strategy).
4. Restricted (PII): Personal Data subject to privacy laws.
5. Highly Restricted (Sensitive PII): Health, Biometric, Financial, PIPL "Sensitive" data.

5.2. Data Residency Requirements

• China (PIPL): All Personal Information collected in China must be stored on servers physically located within Mainland China. Cross-border transfer is prohibited unless a strict exemption is granted (see Section 6).
• European Union (GDPR): Data may be stored outside the EEA only if the destination country has an Adequacy Decision or appropriate safeguards (SCCs) are in place.
• United States (CCPA): No strict residency requirement, but data security must be "reasonable."
• Default Rule: In the absence of a specific transfer mechanism, data shall remain stored in the region of origin.

---

6. CROSS-BORDER DATA TRANSFERS

Transferring data across borders is a high-risk activity. A Data Transfer Impact Assessment (DTIA) is required before any transfer.

6.1. Transfer Mechanisms by Region

Origin Region	Destination Region	Required Mechanism
EEA (GDPR)	Any Non-Adequate Country	Standard Contractual Clauses (SCCs) + Supplementary Measures.
China (PIPL)	Outside China	1. CAC Security Assessment (if volume thresholds met); OR 2. Personal Information Protection Certification; OR 3. Standard Contracts filed with CAC. Plus: Separate consent from data subject.
California (CCPA)	Any	"Sale/Sharing" Opt-Out mechanism required if transfer constitutes a "Sale" or "Sharing" for cross-context behavioral advertising.

6.2. Prohibited Transfers

• Transfer of Chinese "Important Data" (as defined by Chinese regulators) is strictly prohibited without explicit government approval.
• Transfer of EU data to countries without adequate protection is prohibited without SCCs.

6.3. "Highest Standard" Harmonization

Where regulations conflict, the stricter standard applies to the specific data flow.

• Example: If GDPR allows a transfer but PIPL forbids it for the same dataset, the transfer is blocked.
• Example: Consent for marketing must be "Opt-In" (GDPR/PIPL) even if CCPA allows "Opt-Out."

---

7. ROLE-BASED ACCESS CONTROLS (RBAC)

Access to Personal Data is granted based on the Principle of Least Privilege.

7.1. Access Granting Process

1. Request: Access must be requested via the Identity and Access Management (IAM) system.
2. Approval: Requires approval from the Data Owner and the employee's Line Manager.
3. Justification: The business need must be documented and linked to a specific role.
4. Sensitive Data: Access to "Highly Restricted" data requires additional approval from the Regional Privacy Lead.

7.2. Authentication Standards

• MFA: Multi-Factor Authentication is mandatory for all systems containing Restricted Data.
• Privileged Access: Admin access to databases housing Personal Data must be time-bound and logged.

7.3. Access Review

• Quarterly Review: Data Owners must review access lists for their systems quarterly.
• Leaver Process: IT must revoke all access within 24 hours of employment termination.
• Mover Process: Access rights must be reset when an employee changes roles to prevent "privilege creep."

---

8. REGULATORY COMPLIANCE OBLIGATIONS

8.1. General Data Protection Regulation (GDPR) - EU/UK

• Lawful Basis: All processing must have a documented lawful basis (Consent, Contract, Legitimate Interest, etc.).
• Privacy by Design: DPIA (Data Protection Impact Assessment) is mandatory for high-risk processing.
• Data Subject Rights: Requests must be fulfilled within 30 calendar days.
• Breach Notification: Supervisory Authority must be notified within 72 hours of awareness.

8.2. California Consumer Privacy Act (CCPA/CPRA) - USA

• Notice at Collection: Specific notice must be displayed at the point of data collection.
• Right to Opt-Out: A clear "Do Not Sell or Share My Personal Information" link must be available on all digital properties.
• Non-Discrimination: Services cannot be denied to users who exercise privacy rights.
• Data Subject Rights: Requests must be fulfilled within 45 calendar days (extendable to 90).

8.3. Personal Information Protection Law (PIPL) - China

• Separate Consent: Consent for cross-border transfer or sensitive data must be obtained separately from general terms of service.
• Local Representative: [Company Name] shall maintain a designated PIPL Representative in China for liaison with regulators.
• Data Subject Rights: Requests must be fulfilled within 15 working days.
• Automated Decision Making: Users have the right to opt-out of algorithmic decision-making (profiling).

---

9. DATA SUBJECT RIGHTS (DSR) MANAGEMENT

[Company Name] will operate a Unified Privacy Portal to intake requests, routed to regional teams for adjudication.

Right	GDPR	CCPA	PIPL	Company Standard (Global Minimum)
Access/Portability	Yes	Yes	Yes	Honor globally where technically feasible.
Deletion	Yes	Yes	Yes	Honor unless legal retention obligation exists.
Correction	Yes	Yes	Yes	Honor globally.
Opt-Out (Sale)	N/A	Yes	N/A	Global "Do Not Sell" switch enabled.
Withdraw Consent	Yes	N/A	Yes	Honor globally immediately.
Response Time	30 Days	45 Days	15 Work Days	15 Working Days (to satisfy strictest).

---

10. DATA SECURITY AND INCIDENT RESPONSE

10.1. Security Controls

• Encryption: All Restricted Data must be encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Key Management: Encryption keys for Chinese data must be managed within China.
• Anonymization: Data used for testing or analytics must be anonymized or pseudonymized wherever possible.

10.2. Breach Response

In the event of a data breach:

1. Containment: IT Security to isolate affected systems immediately.
2. Assessment: Privacy Office to assess impact on Personal Data.
3. Notification: Legal Counsel to determine notification obligations based on the jurisdiction of the affected data subjects.
   • Rule: Notify according to the strictest timeline applicable to the affected population (e.g., if EU and US users are affected, the 72-hour GDPR clock starts).

---

11. THIRD-PARTY RISK MANAGEMENT

• Vendor Due Diligence: All vendors processing Personal Data must undergo a privacy and security assessment prior to engagement.
• Data Processing Agreements (DPA): A DPA compliant with GDPR, CCPA, and PIPL must be signed before data sharing.
• Audit Rights: [Company Name] retains the right to audit vendors for compliance with this Policy.

---

12. ENFORCEMENT AND DISCIPLINARY ACTION

• Audits: The Internal Audit team will conduct annual audits of Data Governance compliance.
• Violations: Violations of this Policy may result in disciplinary action, up to and including termination of employment.
• Legal Liability: Employees may be held personally liable for willful misconduct resulting in regulatory fines.

---

13. POLICY EXCEPTIONS

Exceptions to this Policy (e.g., emergency cross-border transfer for legal defense) must be:

1. Approved in writing by the Chief Privacy Officer and General Counsel.
2. Documented in the Risk Register.
3. Time-bound and reviewed within 30 days.

---

14. REVIEW AND MAINTENANCE

This Policy shall be reviewed annually by the Global Data Governance Council. Updates will be triggered by:

• Changes in applicable laws (GDPR, CCPA, PIPL).
• Significant changes in business operations or data processing activities.
• Findings from internal or external audits.

---

Acknowledgement All employees must acknowledge receipt and understanding of this Policy annually via the Learning Management System (LMS).

Approved By: _______________________ (CEO) Date: _______________________