What personal information about customers and employees does the organization collect and retain?
What personal information does the organization need and use in carrying out business, for example, in sales, marketing, fund raising, and customer relations activities?
What personal information is obtained from or disclosed to affiliates or third parties, for example, in payroll outsourcing?
What is the impact of United States privacy laws and regulations, and/or international privacy requirements, on the organization (which may require a legal interpretation)?
How does the organization’s business plan address the privacy of personal information?