Check reasonable steps to protect personal information an organisation holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Make a short control list from the facts: what was collected, where it is stored, who has access, whether it is encrypted, what the service-provider contract requires, and how records are thrown away. Tie each gap to a lesson on the FTC page.
- What the lawyer must review
- The FTC Start with Security guide treats reasonable security as a set of choices matched to the business and the sensitivity of the information. Lessons on the page include not collecting data the business does not need, restricting access to a need-to-know basis, requiring secure passwords and authentication, requiring service providers to implement reasonable security measures, and disposing of paper and equipment that still contain personal information. The guide names Social Security numbers among the data exposed when those controls failed in the cases it describes. The Data Breach Response guide is the companion for what to do if the controls fail: secure the scene, call counsel, and notify under the state and federal rules that apply to the information.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Preserve original files and relevant metadata. Document provenance and handling, and seek forensic review where authenticity needs to be resolved.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.