[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpt-3":3},{"item":4,"lessons":18,"controls":68,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pt-3","PT-3","Personally Identifiable Information Processing Purposes",22,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must identify and document the purposes for processing personally identifiable information, describe them in privacy notices and policies, restrict processing to compatible purposes and monitor changes to processing.\n\n**In practice.** This mirrors the GDPR purpose limitation principle. Good practice is a record of processing activities that states each purpose, review of new projects against documented purposes, and assessment of compatibility before reusing data for something new. Auditors expect the documented purposes, review records and evidence that processing changes trigger an update. Privacy impact assessments are a natural point to check purpose.\n\n**Common gaps.** Data collected for one purpose is often reused for analytics, AI training or marketing without assessing compatibility. Records of purposes go stale as systems evolve.","a. Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information;\n  b. Describe the purpose(s) in the public privacy notices and policies of the organization;\n  c. Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and\n  d. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].\nDiscussion: Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term \"process\" includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed. This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization’s privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, computer matching notices, and other applicable Federal Register notices.\n\nOrganizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information.\n\nOrganizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate. Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"italian-meteorological-institute-fined-for-unlawful-cctv-surveillance-without-dpia-or-employee-notic","Italian Meteorological Institute Fined for Unlawful CCTV Surveillance Without DPIA or Employee Notice","2026-10-07T08:21:59.854+00:00",{"slug":25,"title":26,"published_at":27},"greek-dpa-fines-dei-and-call-center-partners-880k-for-gdpr-marketing-violations","Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations","2026-10-05T10:20:23.718+00:00",{"slug":29,"title":30,"published_at":31},"caixabank-fined-408k-for-gdpr-data-minimization-and-transparency-failures","CaixaBank Fined €408K for GDPR Data Minimization and Transparency Failures","2026-09-23T10:22:01.716+00:00",{"slug":33,"title":34,"published_at":35},"caixabank-fined-408k-for-gdpr-data-minimization-failures-in-inheritance-processes","CaixaBank Fined €408K for GDPR Data Minimization Failures in Inheritance Processes","2026-09-22T14:21:15.7+00:00",{"slug":37,"title":38,"published_at":39},"dormeo-home-fined-for-ignoring-gdpr-opt-out-requests","Dormeo Home Fined for Ignoring GDPR Opt-Out Requests","2026-09-15T14:21:24.393+00:00",{"slug":41,"title":42,"published_at":43},"austrian-supreme-court-rules-gdpr-purpose-limitation-bars-repurposing-marketing-data-for-credit-iden","Austrian Supreme Court Rules GDPR Purpose Limitation Bars Repurposing Marketing Data for Credit Identity Checks","2026-09-14T08:20:20.504+00:00",{"slug":45,"title":46,"published_at":47},"spanish-firm-fined-4000-for-disproportionate-workplace-audio-recording-via-cctv","Spanish Firm Fined €4,000 for Disproportionate Workplace Audio Recording via CCTV","2026-09-08T08:20:18.103+00:00",{"slug":49,"title":50,"published_at":51},"crif-violated-gdpr-purpose-limitation-faces-class-action","CRIF Violated GDPR Purpose Limitation, Faces Class Action","2026-09-01T10:23:04.283+00:00",{"slug":53,"title":54,"published_at":55},"italian-dpa-fines-il-fatto-quotidiano-for-publishing-sensitive-health-data-in-violation-of-gdpr","Italian DPA Fines Il Fatto Quotidiano for Publishing Sensitive Health Data in Violation of GDPR","2026-08-26T10:21:57.802+00:00",{"slug":57,"title":58,"published_at":59},"finland-dpa-reprimands-controller-for-unlawful-publication-of-suspended-athletes-personal-data","Finland DPA Reprimands Controller for Unlawful Publication of Suspended Athletes' Personal Data","2026-08-25T10:20:35.401+00:00",{"slug":61,"title":62,"published_at":63},"italian-publisher-fined-280k-for-marketing-emails-sent-without-valid-gdpr-consent","Italian Publisher Fined €280K for Marketing Emails Sent Without Valid GDPR Consent","2026-08-20T14:22:13.691+00:00",{"slug":65,"title":66,"published_at":67},"unlawful-employee-feedback-processing-missing-legal-basis-triggers-austrian-dpa-ruling","Unlawful Employee Feedback Processing: Missing Legal Basis Triggers Austrian DPA Ruling","2026-08-11T14:20:23.064+00:00",[69,74,79,84,88,92],{"slug":70,"name":71,"problem":72,"stories":73},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",8,{"slug":75,"name":76,"problem":77,"stories":78},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",7,{"slug":80,"name":81,"problem":82,"stories":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",1,{"slug":85,"name":86,"problem":87,"stories":83},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":89,"name":90,"problem":91,"stories":83},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":93,"name":94,"problem":95,"stories":83},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[97,103,108,113,118,123,127,132],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",20,{"family":104,"item":105,"code":106,"title":107,"together":102},"gdpr","5","Article 5(1)(f)","Principles relating to processing of personal data",{"family":5,"item":109,"code":110,"title":111,"together":112},"pt-2","PT-2","Authority to Process Personally Identifiable Information",15,{"family":114,"item":115,"code":116,"title":116,"together":117},"itil","overview","ITIL",14,{"family":119,"item":120,"code":121,"title":122,"together":117},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",{"family":104,"item":124,"code":125,"title":126,"together":117},"13","Article 13","Information to be provided where personal data are collected from the data subject",{"family":104,"item":128,"code":129,"title":130,"together":131},"35","Article 35","Data protection impact assessment",12,{"family":104,"item":133,"code":134,"title":135,"together":136},"6","Article 6","Lawfulness of processing",11]