Cloud data privacy lifecycle — CSA CCM v4 DSP control family
Primary statement
Cloud data privacy lifecycle per CSA CCM v4 DSP series: policy + data flow mapping + automated sensitive data discovery + classification + DLP. Layered with GDPR + DPDPA + ISO 27701 + MHMDA + MODPA. Integrated approach to managing personal data in cloud environments.
Audit-fatigue payoff
A unified cloud data privacy programme — DSP-01 through DSP-05 plus regulatory addenda — satisfies cloud data privacy requirements across all 7 contributing frameworks.
Strictness matrix
Scope
Scope: current data flow maps documenting where personal and sensitive data is stored, processed, transmitted across cloud environments — including subprocessors.
Ceiling source: csa_ccm:CSA.DSP-02
Rationale: CSA DSP-02 data flow mapping is the most comprehensive cloud-specific scope.
Threshold
Threshold: automated sensitive data discovery and classification to identify PII, financial, health, IP across cloud workloads. Automation is the binary threshold — manual discovery insufficient at cloud scale.
Ceiling source: csa_ccm:CSA.DSP-03
Rationale: CSA DSP-03 automated discovery threshold is uniquely strict.
Method
Method: documented privacy policy (DSP-01) + data flow mapping (DSP-02) + automated discovery and classification (DSP-03) + classification scheme (DSP-04) + cloud DLP (DSP-05) + regulatory addenda per applicable laws.
Ceiling source: csa_ccm:CSA.DSP-01
Rationale: CSA DSP series is the canonical cloud data privacy method.
Frequency
Policy review: annual minimum. Data flow map refresh: continuous through change management + quarterly reconciliation. Automated discovery: continuous. Classification scheme review: annual.
Ceiling source: csa_ccm:CSA.DSP-01
Rationale: CSA DSP-01 annual review + continuous discovery is the audit-defensible cadence.
Evidence
Evidence: privacy policy + data flow maps + automated discovery results + classification register + cloud DLP deployment + regulatory addenda library.
Ceiling source: csa_ccm:CSA.DSP-02
Rationale: CSA DSP-02 evidence with data flow maps is the audit anchor.
Auditor test pattern
Step 1: Inspect cloud privacy policy. Step 2: Inspect data flow maps. Step 3: Verify automated discovery operational. Step 4: Inspect classification scheme. Step 5: Verify cloud DLP coverage.
Common findings
Common findings: (1) Data flow maps stale; (2) Automated discovery limited to one cloud provider; (3) Classification scheme legacy, not cloud-aligned; (4) DLP at endpoint but not cloud workload.