Lessons Learned While Building a Privacy Operations Center at...
summary
Built a Privacy Operations Center at Headspace Health to cover 150+ countries and HIPAA GDPR CCPA requirements, organized into four pillars: governance, partnerships, tools, and security awareness. Invented a custom data classification and live inventory, rejected off‑the‑shelf DSR tools and built an internal DSR processor, rolled out a PRD review workflow in April that has pen tested three features and reviewed four PRDs. Uses Privado and Amazon Glue for data tagging, dual encryption with a browser‑stored key, HIPAA‑specific training and a master privacy FAQ.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:14Assumptions
- 6:30Privacy is not
- 9:05Guiding Principles of Privacy (1/4)
- 12:17What constitutes a POC?
- 12:58Data Management v/s Data Governance
- 14:50Headspace Health Data Classification
- 16:28Milestone for initial inventory
- 19:21Privacy Impact Assessments
- 20:07Privacy & Security Review Procedure
- 24:39Privacy Threat Modeling - Data Oriented
- 25:31Privacy Threat Modeling - Process Oriented
- 26:05Privacy Awareness
- 28:26Summary
- 31:25Resources
related talks
50mHeadspace's Privacy Operations Center and Vault
40mData Privacy and Security by Design
37mFrom the Trenches Privacy Engineering Pitfalls Successes
35mWinning Customer Trust with A Privacy Center
42mPrivacy as a Brand Differentiator
28mTurning Privacy Compliance into a Business-Enabler
40mExtreme Makeover: Privacy Edition
20mThe Journey To Data Stewardship: A Practical Framework To Future Proof Your Privacy Program