ComplianceNIST 800-53 control
NIST-PT-5 Privacy Notice
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- PT Personally Identifiable Information Processing and Transparency
- Control
- PT-5
Control statement
Provide notice to individuals about the processing of personally identifiable information that:
a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: frequency];
b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
c. Identifies the authority that authorizes the processing of personally identifiable information;
d. Identifies the purposes for which personally identifiable information is to be processed; and
e. Includes [Assignment: information].
Discussion
Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices.
Privacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon.
Related
Related control · Compliance (9)
- NIST-PM-20 Dissemination of Privacy Program Information NIST 800-53 control
- NIST-PM-22 Personally Identifiable Information Quality Management NIST 800-53 control
- NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
- NIST-PT-3 Personally Identifiable Information Processing Purposes NIST 800-53 control
- NIST-PT-4 Consent NIST 800-53 control
- NIST-PT-7 Specific Categories of Personally Identifiable Information NIST 800-53 control
- NIST-RA-3 Risk Assessment NIST 800-53 control
- NIST-SC-42 Sensor Capability and Data NIST 800-53 control
- NIST-SI-18 Personally Identifiable Information Quality Operations NIST 800-53 control
Referenced by Compliance · enhancement of (2)
- NIST-PT-5(1) Just-in-time Notice NIST 800-53 enhancement
- NIST-PT-5(2) Privacy Act Statements NIST 800-53 enhancement
Referenced by Compliance · has member (1)
- NIST-PT Personally Identifiable Information Processing and Transparency NIST 800-53 family
Referenced by Compliance · related control (10)
- NIST-AT-3(5) Processing Personally Identifiable Information NIST 800-53 enhancement
- NIST-IR-8(1) Breaches NIST 800-53 enhancement
- NIST-PM-20 Dissemination of Privacy Program Information NIST 800-53 control
- NIST-PM-5(1) Inventory of Personally Identifiable Information NIST 800-53 enhancement
- NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
- NIST-PT-3 Personally Identifiable Information Processing Purposes NIST 800-53 control
- NIST-PT-4 Consent NIST 800-53 control
- NIST-PT-6 System of Records Notice NIST 800-53 control
- NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
- NIST-SC-42(4) Notice of Collection NIST 800-53 enhancement