I need to prove our organisation’s competence in privacy and data protection. I need assurances and evidence that our business protects personal information. My board and investors need to guarantee that our management of privacy risk is effective and sustainable.