Check the steps taken to protect personal information the business holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Against the Start with Security lessons, list whether the business collected information it did not need, who can reach the stored data, how passwords are set, whether service providers are required to use reasonable security, and how paper and devices are disposed of.
- What the lawyer must review
- The FTC Start with Security guide says sound security starts by assessing the sensitivity of the information, that a business should not collect sensitive information it does not need, and that once it has a legitimate need to hold the data it should take reasonable steps to keep it secure, including need-to-know access. It says service providers should implement reasonable security measures, and it points to FTC cases about clear-text storage, shared administrative keys, and disposal of prescriptions in dumpsters. The Data Breach Response guide tells a business that has had a breach to secure the physical areas, consult counsel on the federal and state laws that may apply, and avoid misleading statements about the breach. Neither page is a certification checklist that replaces the lawyer's judgement about whether the steps fit the data.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.