What it asks for. This control expects the organisation to identify and meet its requirements for preserving privacy and protecting personally identifiable information, in line with applicable laws, regulations and contracts.
In practice. Good practice starts with knowing which legal requirements apply, such as GDPR, and where personal data is processed. Responsibilities are assigned, often to a privacy officer, and supported by policies, records of processing, data protection impact assessments and technical measures such as access control and encryption. Auditors expect to see this inventory of obligations and data, assigned roles and evidence that controls are applied and reviewed.
Common gaps. Typical gaps are privacy handled entirely by legal without links to security controls, incomplete records of processing and no review when systems change.