• Privacy accountability sits at the executive level, with the CIO and CDO serving as the organization's privacy leadership.
• Privacy-incident escalation and notification procedures are defined within the incident response and disaster recovery plans, covering escalation paths and notification obligations.
• A privacy notice is published describing how personal information is collected, used, and protected.

Framework Alignment: NIST CSF GV.OC, GV.RR; GDPR Art. 37-39, 33/34, 12-14; ISO 27001:2022 A.5.34, A.5.31