NIST SP 800-53 Rev 5
PT - PII Processing and Transparency

NIST SP 800-53 Rev 5 NIST800-PT-5: PT-5 Privacy Notice

Provide notice to individuals about the processing of personally identifiable information that: a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency]; b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language; c. Identifies the authority that authorizes the processing of personally identifiable information; d. Identifies the purposes for which personally identifiable information is to be processed; and e. Includes [Assignment: organization-defined information].

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 50 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27701:2019 · 18 controls

  • 5.5.4 Communication
  • 7.2 Conditions for collection and processing
  • 7.2.7 Joint PII controller
  • 7.3 Obligations to PII principals
  • 7.3.1 Determining and fulfilling obligations to PII principals
  • 7.3.2 Determining information for PII principals
  • 7.3.3 Providing information to PII principals
  • 7.3.6 Access, correction and/or erasure
  • 7.3.7 PII controllers' obligations to inform third parties
  • 7.3.9 Handling requests
  • 7.5 PII sharing, transfer, and disclosure
  • 7.5.2 Countries and international organizations to which PII can be transferred
  • 8.2 Conditions for collection and processing
  • 8.2.3 Marketing and advertising use
  • 8.2.5 Customer obligations
  • 8.3 Obligations to PII principals
  • 8.3.1 Obligations to PII principals
  • 8.5.6 Disclosure of subcontractors used to process PII

SOC 2 · 6 controls

  • SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
  • SOC2-P1.1 P1.1 Privacy notice to data subjects
  • SOC2-P2.1 P2.1 Choice and consent
  • SOC2-P3.1 P3.1 Collecting personal information consistent with objectives
  • SOC2-P3.2 P3.2 Explicit consent before collecting information that requires it
  • SOC2-P6.1 P6.1 Disclosure to third parties with consent

APEC Cross-Border Privacy Rules (CBPR) System · 4 controls

ISO/IEC 42001:2023 · 4 controls

  • 7.4 Communication
  • A.8 Information for interested parties of AI systems
  • A.8.2 System documentation and information for users
  • A.8.5 Information for interested parties

GDPR · 3 controls

  • GDPR-Art.12 Transparent information, communication and modalities for rights
  • GDPR-Art.13 Information to be provided where personal data are collected
  • GDPR-Art.14 Information where personal data have not been obtained from the data subject

APPI · 2 controls

  • APPI-A21 Notice or Public Announcement of the Purpose of Use
  • APPI-A32 Matters Concerning Retained Personal Data to Be Made Accessible

Australia Consumer Data Right - Banking (CDR) · 2 controls

  • AUCDR-PS-1 Privacy Safeguard 1 - Open and transparent management of CDR data
  • AUCDR-PS-5 Privacy Safeguard 5 - Notifying of the collection of CDR data

EU AI Act · 2 controls

  • EUAI-Art.50 Transparency obligations for providers and deployers of certain AI systems
  • EUAI-Art.86 Right to explanation of individual decision-making

Australia My Health Records Act 2012 · 1 control

  • MYHR-SBD-4 Notice where information is not being shared

CMMC 2.0 · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

DORA · 1 control

ISO 22301:2019 · 1 control

  • 4.2.2 Legal and regulatory requirements

ISO 27001:2022 · 1 control

  • 5.34 Privacy and protection of personal identifiable information (PII)

ISO 27002:2022 · 1 control

  • 5.34 Privacy and protection of PII

NIST SP 800-161 Rev 1 · 1 control

  • 161R1-PM-20 Dissemination of Privacy Program Information

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in PT - PII Processing and Transparency

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-PT-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls