ComplianceNIST 800-53 control

NIST-PT-3 Personally Identifiable Information Processing Purposes

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
PT Personally Identifiable Information Processing and Transparency
Control
PT-3

Control statement

a. Identify and document the [Assignment: purpose(s)] for processing personally identifiable information; b. Describe the purpose(s) in the public privacy notices and policies of the organization; c. Restrict the [Assignment: processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and d. Monitor changes in processing personally identifiable information and implement [Assignment: mechanisms] to ensure that any changes are made in accordance with [Assignment: requirements].

Discussion

Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term "process" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization’s privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching notices, and other applicable Federal Register notices. Organizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information. Organizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.

Related

Related control · Compliance (15)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-CM-13 Data Action Mapping NIST 800-53 control
  • NIST-IR-9 Information Spillage Response NIST 800-53 control
  • NIST-PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research NIST 800-53 control
  • NIST-PM-9 Risk Management Strategy NIST 800-53 control
  • NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
  • NIST-PT-5 Privacy Notice NIST 800-53 control
  • NIST-PT-6 System of Records Notice NIST 800-53 control
  • NIST-PT-7 Specific Categories of Personally Identifiable Information NIST 800-53 control
  • NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
  • NIST-SC-43 Usage Restrictions NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-18 Personally Identifiable Information Quality Operations NIST 800-53 control

Referenced by Compliance · enhancement of (2)

Referenced by Compliance · has member (1)

  • NIST-PT Personally Identifiable Information Processing and Transparency NIST 800-53 family

Referenced by Compliance · related control (16)

  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AT-3(5) Processing Personally Identifiable Information NIST 800-53 enhancement
  • NIST-CM-13 Data Action Mapping NIST 800-53 control
  • NIST-IR-8(1) Breaches NIST 800-53 enhancement
  • NIST-IR-9 Information Spillage Response NIST 800-53 control
  • NIST-PM-25 Minimization of Personally Identifiable Information Used in Testing, Training, and Research NIST 800-53 control
  • NIST-PM-5(1) Inventory of Personally Identifiable Information NIST 800-53 enhancement
  • NIST-PM-9 Risk Management Strategy NIST 800-53 control
  • NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
  • NIST-PT-5 Privacy Notice NIST 800-53 control
  • NIST-PT-6 System of Records Notice NIST 800-53 control
  • NIST-PT-7 Specific Categories of Personally Identifiable Information NIST 800-53 control
  • NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control