[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpt-1":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pt-1","PT-1","Policy and Procedures",36,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must develop, document and disseminate a policy and procedures for personally identifiable information processing and transparency, designate an official to manage them, and review and update them at defined frequencies and after relevant events.\n\n**In practice.** Doing this well means a privacy policy and supporting procedures covering lawful processing, transparency, consent, data minimisation and individual rights, owned by a privacy lead or data protection officer. Auditors expect approved documents, distribution evidence and review history. In Europe this maps naturally onto GDPR accountability requirements. Procedures should explain how staff handle requests from individuals, new processing activities and privacy incidents.\n\n**Common gaps.** Policies are often copied from templates and not reflected in operational procedures. Review dates pass without updates after regulatory or business changes. Responsibility can also be unclear between the privacy, legal and security functions.","a. Develop, document, and disseminate to [Assignment: organization-defined organization-defined personnel or roles]:\n    1. [Selection: organization-level; mission\u002Fbusiness process-level; system-level] personally identifiable information processing and transparency policy that:\n      (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and\n      (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and\n    2. Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;\n  b. Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and\n  c. Review and update the current personally identifiable information processing and transparency:\n    1. Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and\n    2. Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].\nDiscussion: Personally identifiable information processing and transparency policy and procedures address the controls in the PT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of personally identifiable information processing and transparency policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to personally identifiable information processing and transparency policy and procedures include assessment or audit findings, breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"norway-fines-xandr-for-unlawful-personal-data-processing-tied-to-grindr","Norway Fines Xandr for Unlawful Personal Data Processing Tied to Grindr","2026-10-14T14:21:53.44+00:00",{"slug":25,"title":26,"published_at":27},"xandr-fined-96m-for-unlawful-sharing-of-grindr-users-sensitive-data","Xandr Fined $9.6M for Unlawful Sharing of Grindr Users' Sensitive Data","2026-10-12T22:20:35.997+00:00",{"slug":29,"title":30,"published_at":31},"eu-parliament-members-undermining-gdpr-know-who-represents-your-privacy","EU Parliament Members Undermining GDPR: Know Who Represents Your Privacy","2026-10-12T04:20:19.966+00:00",{"slug":33,"title":34,"published_at":35},"italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","2026-10-07T08:21:59.854+00:00",{"slug":37,"title":38,"published_at":39},"irish-high-court-shifts-gdpr-compliance-burden-to-data-controllers","Irish High Court Shifts GDPR Compliance Burden to Data Controllers","2026-10-06T14:20:38.429+00:00",{"slug":41,"title":42,"published_at":43},"irish-high-court-shifts-compliance-burden-to-microsoft-in-gdpr-real-time-bidding-case","Irish High Court Shifts Compliance Burden to Microsoft in GDPR Real-Time Bidding Case","2026-10-05T10:21:22.914+00:00",{"slug":45,"title":46,"published_at":47},"irish-high-court-clarifies-gdpr-compliance-burden-of-proof-for-data-controllers","Irish High Court Clarifies GDPR Compliance Burden of Proof for Data Controllers","2026-10-02T10:21:37.022+00:00",{"slug":49,"title":50,"published_at":51},"espoo-schools-misuse-google-edtech-tools-violating-gdpr-consent-rules","Espoo Schools Misuse Google EdTech Tools, Violating GDPR Consent Rules","2026-09-28T19:21:53.257+00:00",{"slug":53,"title":54,"published_at":55},"edpb-issues-new-gdpr-fine-guidelines-and-dsa-gdpr-interaction-rules","EDPB Issues New GDPR Fine Guidelines and DSA-GDPR Interaction Rules","2026-09-23T19:21:31.878+00:00",{"slug":57,"title":58,"published_at":59},"cjeu-clarifies-gdpr-fines-apply-to-private-entities-performing-public-tasks","CJEU Clarifies GDPR Fines Apply to Private Entities Performing Public Tasks","2026-09-23T12:21:43.465+00:00",{"slug":61,"title":62,"published_at":63},"cjeu-rules-private-entities-cannot-be-exempted-from-gdpr-fines-via-national-law","CJEU Rules Private Entities Cannot Be Exempted from GDPR Fines via National Law","2026-09-23T10:20:40.117+00:00",{"slug":65,"title":66,"published_at":67},"german-federal-court-expands-gdpr-enforcement-national-injunctions-now-permissible-for-unlawful-data","German Federal Court Expands GDPR Enforcement: National Injunctions Now Permissible for Unlawful Data Transfers","2026-09-23T08:21:44.988+00:00",[69,74,78,83,88,92],{"slug":70,"name":71,"problem":72,"stories":73},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",12,{"slug":75,"name":76,"problem":77,"stories":73},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":79,"name":80,"problem":81,"stories":82},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",6,{"slug":84,"name":85,"problem":86,"stories":87},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",3,{"slug":89,"name":90,"problem":91,"stories":87},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",{"slug":93,"name":94,"problem":95,"stories":96},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[98,104,110,116,120,126,131,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",30,{"family":105,"item":106,"code":107,"title":108,"together":109},"cis","3","Control 3","Data Protection",29,{"family":111,"item":112,"code":113,"title":114,"together":115},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",25,{"family":117,"item":100,"code":118,"title":118,"together":119},"itil","ITIL",23,{"family":121,"item":122,"code":123,"title":124,"together":125},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",21,{"family":121,"item":127,"code":128,"title":129,"together":130},"6","Article 6","Lawfulness of processing",16,{"family":121,"item":132,"code":133,"title":134,"together":73},"35","Article 35","Data protection impact assessment",{"family":121,"item":136,"code":137,"title":138,"together":139},"13","Article 13","Information to be provided where personal data are collected from the data subject",11]