AICPA Privacy Management Framework (PMF) PMF-ME.2: Complaint Handling

What else in your programme already covers this

This control maps to 178 controls across 56 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

GDPR · 6 controls

GDPR-Art.10 Processing of personal data relating to criminal convictions
GDPR-Art.11 Processing which does not require identification
GDPR-Art.12 Transparent information, communication and modalities for rights
GDPR-Art.15 Right of access by the data subject
GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction
GDPR-Art.9 Processing of special categories of personal data

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 6 controls

CH-FADP-02 Principles of lawful processing
CH-FADP-04 Data subject access right
CH-FADP-05 Data accuracy and rectification
FADP-11 Duty to Inform (Article 19)
FADP-12 Right of Access (Article 25)
FADP-15 Data Breach Notification

Tanzania Personal Data Protection Act (Draft) · 4 controls

TANZANIA-1 Scope, Registration, Lawful Basis
TANZANIA-3 Data Subject Rights
TANZANIA-4 Security and Cross-Border
TANZANIA-5 DPO, Governance, Breach

Trinidad and Tobago Data Protection Act 2011 · 4 controls

TRINIDAD-1 Scope, Definitions, Commission
TRINIDAD-3 Data Subject Rights
TRINIDAD-4 Security, Accuracy
TRINIDAD-5 Enforcement and Sanctions

UK Age Appropriate Design Code (Children's Code) · 4 controls

Standard 13 Nudge Techniques
Standard 14 Connected Toys and Devices
Standard 5 Detrimental Use of Data
Standard 8 Data Minimisation

APPI · 3 controls

APPI-A23 Security Control Measures
APPI-A24 Supervision of Employees
APPI-A33 Request for Disclosure of Retained Personal Data

Armenia Law on Protection of Personal Data (2015) · 3 controls

AM-DPA-15 Breach Response and Notification
AM-DPA-16 Staff Training and Confidentiality
AM-DPA-17 PDPA Inspections and Cooperation

Australian Privacy Principles (APPs) · 3 controls

APP-1 APP 1 - Open and transparent management of personal information
APP-3 APP 3 - Collection of solicited personal information
APP-5 APP 5 - Notification of the collection of personal information

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement)
AT-DSG-13 Section 36 - Scope of law enforcement processing
AT-DSG-14 Section 38 - Lawfulness of law enforcement processing

Azerbaijan Law on Personal Data (2010) · 3 controls

AZ-DPA-12 Article 13 - Cross-border transfer
AZ-DPA-14 Article 16 - Liability for violations
AZ-DPA-15 Article 17 - Dispute resolution

Bahrain PDPL · 3 controls

BH-PDPL-02 Consent management and withdrawal
BH-PDPL-05 Data minimization requirements
BH-PDPL-22 Privacy by design and default

Barbados Data Protection Act 2019 · 3 controls

BB-DPA-14 Section 15 - Right to Data Portability
BB-DPA-16 Section 22 - General Principle for Transfers
BB-DPA-21 Sections 61-69 - Data Privacy Officer

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

ISO/IEC 29100:2024 · 3 controls

29100-6.10 Information security
29100-6.5 Use, retention and disclosure limitation
29100-6.9 Accountability

ISO/IEC 29134:2023 · 3 controls

29134-1 Scope
29134-3 Terms and definitions
29134-9.1 PIA report structure

SASB Standards · 3 controls

SASB-4 Social Capital (SC)
SASB-SC-1 Customer Privacy and Data Security
SASB-SOC-2 Customer Privacy

SOC 2 · 3 controls

SOC2-P3.1 Personal information is collected consistent with privacy commitments
SOC2-P4.3 Personal information is securely disposed of
SOC2-P6.1 Personal information is disclosed to third parties only as committed

Saudi Arabia PDPL · 3 controls

SA-PDPL-13 Encryption of personal data
SA-PDPL-15 Access control for personal data
SA-PDPL-22 Privacy by design and default

South Korea ISMS-P · 3 controls

ISMSP-PI-01 Personal Information Collection
ISMSP-PI-04 Cross-Border Transfer
ISMSP-SYS-02 Encryption Implementation

Sweden Data Protection Act (Dataskyddslag, 2018:218) · 3 controls

SWE-1 Scope and Purpose
SWE-11 Integritetsskyddsmyndigheten (IMY)
SWE-2 Relationship to GDPR

UK Data Protection Act 2018 · 3 controls

UK-DPA18-GEN-04 UK-Specific Exemptions
UK-DPA18-LE-02 Data Subject Rights (Law Enforcement)
UK-DPA18-LE-03 International Transfers (Law Enforcement)

Florida Digital Bill of Rights (FDBR) · 2 controls

FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)
FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704)

ISO/IEC 27014:2020 · 2 controls

29134-1 Scope
29134-3 Terms and definitions

ISO/IEC 27400:2022 · 2 controls

27400-5.4 Data and privacy risks
27400-7.3 Data minimization and purpose limitation

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 2 controls

27557-3 Terms and definitions
27557-4.3 Individual impact consideration

POPIA · 2 controls

POPIASA-3 Data Subject Rights (Access, Correction, Objection), Automated Decisions
POPIASA-4 Special Personal Information, Children, Information Quality, Documentation

Qatar DPL · 2 controls

QATAR-3 Data Subject Rights
QATAR-7 DPO, Records, Retention, Marketing, Training

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

SSAE18-P1.1 P1.1 - Privacy Notice
SSAE18-P1.2 P1.2 - Choice and Consent

Taiwan PDPA · 2 controls

TAIWAN-2 Consent, Notice, Sensitive Data
TAIWAN-3 Data Subject Rights

UK GDPR (UK General Data Protection Regulation) · 2 controls

UKGDPRREG-2 Data Subject Rights (Articles 12-22)
UKGDPRREG-3 Controller and Processor (Articles 24-43)

Uganda Data Protection and Privacy Act (2019) · 2 controls

UGA-13 Unlawful Obtaining or Disclosure
UGA-15 Unauthorized Sale of Data

Uruguay DPL · 2 controls

URUGUAY-1 Scope, Lawful Basis, Consent
URUGUAY-5 Database Registration with AGESIC URCDP

Albania Law on Protection of Personal Data (Law No. 9887, 2008, amended 2014) · 1 control

AL-DPA-12 International Data Transfers

Azure Security Benchmark · 1 control

DS-2 Ensure software supply chain security

COSO Internal Control - Integrated Framework (2013) · 1 control

CA-10 Selects and Develops Control Activities

Estonia Personal Data Protection Act (Isikuandmete kaitse seadus, 2019) · 1 control

EPDPA-1 Scope of Regulation (§1)

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2)

ISO 13485:2016 · 1 control

8.2.2 Complaint handling

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 1 control

27557-3 Terms and definitions

ISO/IEC 23894:2023 · 1 control

ISO23894-A.5 Privacy and Data Protection in AI

ISO/IEC 38500:2024 - Governance of IT · 1 control

38500-5.10 Social responsibility

ITU-T X.805 - Security Architecture for End-to-End Communications · 1 control

X805-Dim8-Privacy-Identification-Network-Activity-Personal-Information-Confidentiality ITU-T X.805 Security Dimension 8 - Privacy + Identification of Network Activity + Personal Information Confidentiality + Subscriber Anonymity + Pseudonymity + Anti-Tracking + Location Privacy + Data Minimization + GDPR/CCPA Alignment

Illinois Biometric Information Privacy Act (BIPA) · 1 control

CTDPA-1 Definitions

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MARSE-SC-01 NIST 800-53 Moderate Baseline

NIST Privacy Framework · 1 control

NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P)

Regional Comprehensive Economic Partnership (RCEP) - E-Commerce Chapter · 1 control

RCEPEC-1 Online Personal Information Protection (12.13)

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

RIDTPPA-11 Data Minimisation and Purpose Limitation

SOC for Cybersecurity - Cybersecurity Risk Management Examination · 1 control

SOC-CY-DC2 Nature of Sensitive Information

Student Privacy Pledge 2020 · 1 control

STUDPRV-2 Data Subject Rights for Students and Parents

TISAX - Trusted Information Security Assessment Exchange · 1 control

TISAXASS-3 Prototype Protection and Confidentiality

Texas Data Privacy Act · 1 control

TEXASTDPSA-3 Sensitive Data, Children, Sale Notice

UK AI Regulation Framework · 1 control

UKAI-2 Sector-Specific Regulator Engagement

UK Open Banking Standard · 1 control

OB-CX.2 Granular Consent Management

UNICEF Policy Guidance on AI for Children (2021) · 1 control

UNICEFAI-4 Transparency, Explanation, Adult Capacity

Virginia CDPA · 1 control

VIRGINIAVCDPA-1 Scope, Applicability, Definitions

WHO Global Strategy on Digital Health 2020-2025 · 1 control

SO3.2 Regulatory frameworks for digital health

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.