Suzette Corley - Cipm, Cdpp Email & Phone Number

KirkpatrickPrice is a licensed information security CPA firm, a PCI QSA, and a HITRUST CSF Assessor, providing assurance services to over 1,000 clients in 48 states, Canada, Europe, Asia, and more. Registered with the PCAOB, KirkpatrickPrice has over 17 years of information security assurance experience performing audits, assessments, and penetration testing that strengthen information security and compliance controls.• Conduct comprehensive Privacy Audits including GDPR, CCPA, SOC 2 Privacy, and HIPAA Privacy Rule compliance.• Utilize a company-developed tool, Online Audit Manager, effectively securely managing client documents.• Collaborate with clients to identify and comply with relevant regulatory requirements, thereby mitigating the risk of non-compliance fines.• Ensure efficient and minimally disruptive examination processes, aligning with professional guidelines.• Guide and educate clients throughout engagements, fostering assurance in their privacy and compliance efforts.• Works closely with clients, enabling them to successfully achieve privacy compliance based on their respective objectives and trust services criteria.

• Conduct audits of business units and identify if business practices, or absence of practices, present significant regulatory, ethical, or legal compliance risks.• Identify compliance deficiencies and areas of risk within business units and work and develop and implement risk mitigation plans.• Partners with Internal Controls, Internal Audit, and Enterprise Risk Management to manage risk from internal and external sources.• Develop Diversity and Inclusion privacy considerations for business products and service development to ensure customer/consumer/employee rights are incorporated.• Act as the face of the company to consumers, state insurance departments, and other regulators during privacy inquiries.• Develop relationships with key stakeholders in business units to effectively respond to consumers and regulators within the exam or inquiry timeline.• Create the development, implementation, and maintenance of privacy policies, standards, and procedures to ensure enterprise compliance with federal/state privacy requirements.• Create the development and facilitate privacy training and awareness campaigns aimed at the enterprise as well as specialized training for specific business units.• Manage third-party vendor and I/S relationships, including adherence to contract terms and service standards. Involves the Sourcing department in vendor issues as appropriate.• Play an intricate role within the Insider Risk team as they develop and consider various alerts and policies for loss of data by insiders. This includes the development of DLP strategic programming.

• Created strategy to implement, develop controls framework, and carry out CCPA to compliance for January 1, 2020, effective date.• Establish, implement, and maintain procedures and processes to effectively manage privacy activities, while ensuring compliance with regulations. Assess issues and manage implementation of process improvements ensuring the establishment of best practices, policies, procedures, and systems that enhance productivity, positively impact the business, and comply with internal and external requirements.• Establish and maintain strong relationships with business stakeholders across the organization to convey security and privacy requirements and maintain knowledge on data collection and use cases. Identify and manage implementation of process and system modifications for data handling, ensuring alignment with external regulations and internal policies.• Collaborated with internal and external stakeholders to evaluate and drive a privacy plan that maximizes value and minimizes risk.• Partner with management in leading the development of ongoing compliance monitoring of external vendors and third parties, to ensure appropriate controls are in place to protect personally identifiable information and address all privacy concerns, requirements, and responsibilities.• Monitor and advise stakeholders across the organization on changes to state, federal and international privacy laws, and accreditation standards (e.g., Japan’s APPI, CCPA, GDPR, New York, and others) to ensure impacted areas are aware of pending changes and possible impacts to the business.

Greater Atlanta Area

• Led the work to stand up the GDPR control framework for the UK region. In conjunction with consultants completed an assessment, analyzed the gaps, created solutions to address those gaps, and implemented those solutions before the May 25th, 2018, deadline. • Created a strategy in preparation for CCPA that included individual rights processing, policy management, and training to meet CCPA requirements.• Produced a Data Protection Strategy which set out the organizational process, policy, and cultural changes needed to enable a successful and lasting transition of GDPR into Business as Usual. • Drove the analysis and impact assessment of the GDPR in the US, including assessment of the data estate; business and system impact assessments, and identifying grounds for processing data. • Embedding Privacy by Design into architecture and Privacy Awareness into company culture; incorporating Privacy Impact Assessments (PIA) into the approvals process; updating Privacy Notices and 3rd Party contract language; preparing for greater data subject rights to access, portability, and erasure. • Analyze and advise on privacy-enhancing technologies such as OneTrust.• Provide ongoing management, and oversight of privacy training program, including the development and delivery of content for privacy training, specifically as required by GDPR and GLBA. • Worked closely with key stakeholders to build relationships and ensure trust including Legal, Marketing, Risk and Compliance, HR, IT, and Security to ensure a coherent approach to GDPR implementation. Established governance structures to enable board-level visibility and endorsement of the GDPR Control Framework.• Strategic member of the governance board to review business cases for acceptable use of data to incorporate in various products and services.

Served as the privacy subject matter expert (SME) and reported directly to the Global Privacy Officer. • Collaborated in the development and implementation of a global privacy program from scratch to include incident response training, procedures, monitoring, controls, risk mitigation planning, and other program elements.• Led key initiatives and activities related to privacy governance to establish solutions that integrate privacy requirements with business priorities. • Conducted and developed Privacy Impact Assessment Procedures, Privacy Inbox Procedures, and Employee Privacy recommendations.• Led UPS in driving awareness and accountability throughout the organization by creating a Global Privacy and Information Security Training Awareness Program that led to greater business transparency while reinforcing trust from customers, business partners, and consumers. • Provided project management for work streams that were created as a result of Steering Committee directives. • Synthesized the existing Information Security document from 50 pages to 12 pages and added Privacy information to create a user-friendly document that could also be used as an audit specification.

Bs, Management

Aas, Legal Studies/Paralegal (Aba Approved)