NIST Privacy Framework, Govern-PGV.MT-P3

If your business meets the CCPA's business-scale thresholds, deriving 50 percent or more of annual revenue from selling or sharing personal information, or having more than $25 million in annual gross revenue and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, complete a cybersecurity audit.

Complete that audit using a qualified, objective, independent auditor, who may be internal or external to the business, and who did not develop, implement, or maintain the cybersecurity program being audited.

Establish formal procedures implementing these principles, and review them, with a self-assessment, at least once every five years.

Be able to demonstrate compliance with these principles on request of the competent authority, the Economic Policy, Planning and Statistics Office.

Register with the Commission as a data controller or data processor of major importance where the Commission so determines, conduct a compliance audit within fifteen months of commencing business and annually thereafter, and file Compliance Audit Returns by 31 March each year in the Ultra-High and Extra-High Level categories.

Take appropriate technical, organizational and staff measures proportionate to the processing's risk, keep them under review, and be able to demonstrate compliance.

Take appropriate technical and organizational measures so you can demonstrate compliance with this law on request, and require anyone with access to personal data under your authority to keep it confidential or be bound by a legal duty of confidentiality.

Be prepared to demonstrate the effectiveness of your transfer safeguards to the Commissioner on request.

Be ready to demonstrate compliance with the transfer safeguards this Law requires, including where a transfer rests on your own compelling legitimate interests, and expect the supervisory authority to prohibit or suspend an outbound transfer to protect data subjects' rights.

Be ready to demonstrate to the Superintendencia de Industria y Comercio, on its request, that you have implemented measures that are appropriate and effective to comply with Ley 1581 de 2012 and Decreto 1074 de 2015 for any artificial intelligence system that processes personal data.

Keep concrete evidence of compliance with each provision you may be complained about: registration, annual Compliance Audit Returns, a filed impact assessment and an approved cross-border transfer instrument show good faith but do not answer a complaint about anything else.

Maintain a record of processing activities and audit the AI system's operation in proportion to its level of risk.