NIST SP 800-122
Data Subject Rights

NIST SP 800-122 NISTSP122-3: PII Data Subject Rights and Automated Decision-Making

Honour PII data subject rights including: right of access + rectification + erasure/correction + portability + restriction of processing + objection + automated decision-making protections per Privacy Act 1974 access and amendment + state privacy laws + GDPR equivalence where applicable. Apply Section 4 rights with response timelines (30 days under Privacy Act + 45 days under most state privacy laws). Document Automated Decision-Making (ADM) involving PII with human review + safeguards + right to object.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 35 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Section 508 - ICT Accessibility (Revised) · 2 controls

  • 502 Interoperability with Assistive Technology
  • 707 Real-Time Text Functionality

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

  • CH-FADP-09 Notification of data files to the FDPIC
  • FADP-13 Right to Data Portability (Article 28)

APPI · 1 control

  • APPI-A27 Restriction on Provision to Third Parties

Azure Security Benchmark · 1 control

  • DS-2 Ensure software supply chain security

Bahrain PDPL · 1 control

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-14 Section 15 - Right to Data Portability

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-1 Data Integration and Interoperability

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.8 Records of processing activities (UAE PDPL Article 8)

GDPR · 1 control

ISO 8000 - Data Quality · 1 control

  • ISO8000-MDG-01 Master Data Quality

Latvia Personal Data Processing Law (Fizisko personu datu apstrades likums, 2018) · 1 control

  • LV-PDPL-Data-Subject-Rights-Access-Correction-Erasure-Restriction-Portability-Objection-Sec18-Sec38 Latvia PDPL Data Subject Rights + Access + Correction + Erasure + Portability + Section 18 + 38

NIST Privacy Framework · 1 control

  • NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment

New Jersey Data Privacy Act · 1 control

  • NJDPA-4 Sensitive Data, Children, and Adolescents 13-17 Opt-In

Pakistan Personal Data Protection Bill 2023 · 1 control

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-5 APP 12-13 Access and Correction of Personal Information

Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) · 1 control

  • RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out)

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-DAT.3 Data Sharing and Transfer

South Korea PIPA · 1 control

  • PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37

Turkey KVKK · 1 control

  • TURKEYKVKK-1 VERBIS Registration and Lawful Basis

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-STD.4 Interoperability Safety

Vermont Data Privacy and Online Surveillance Act · 1 control

  • VERMONTAICDA-1 AI System Inventory and Risk Assessment

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 35 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-122 controls