As a privacy assessor, what would most likely be the first artefact you would ask...

According to the DSCI Assessment Framework for Privacy (DAF‑P©), a "Personal Information Management Policy" is a foundational artefact that reflects the organization’s commitment and operationalization of privacy practices. It typically defines how personal information is collected, used, disclosed, retained, and disposed of across the organization.

This artefact not only outlines governance structures and responsibilities but also links to other aspects such as risk management, compliance tracking, and privacy notices. Hence, it is the logical first document for a privacy assessor to request.

==============