In scope
- Security and operational events in connected systems
- The context needed to judge whether a change matters
- Who made a material change, and when
- What was decided in response
Trust
Privacy.
How much you watch is a decision about people, not just about systems. Treating it as a technical setting is how monitoring turns into something nobody agreed to.
Where the line sits
Out of scope
- General activity monitoring of individuals
- Content of the work people are doing
- Credential contents, where status is sufficient
- Data from systems the organisation has not connected
The test is whether a piece of data is needed to decide if a change matters and what to do about it. If it is not, collecting it makes the product worse as well as more intrusive.
People in the model
- Understanding a notice
- A person receiving a signal about their own account should be able to understand what changed and what to do, without needing a security background.
- Verifying safely
- Always verify a notice through a route you already trust. Do not share passwords or codes, and contact the organisation that owns the affected service directly.
- Where the relationship sits
- If the affected account or service belongs to another organisation, that organisation owns the relationship and is the right place to resolve it.
- Your organisation's obligations
- Monitoring means handling personal information, so your privacy obligations continue as they do today. Scope design is where that is addressed, not afterwards.
This website
What this site collects.
This is a static website. It sets no cookies, includes no third-party analytics or advertising, and does not track you between visits.
If you send an enquiry, we receive what you typed and use it to answer you. Privacy questions: privacy@maits.co.nz.
Working on a privacy impact assessment?
Tell us the monitoring you have in mind and we will work through what the scope would need to include, and what it should not.