[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fpt-5":3},{"item":4,"lessons":18,"controls":67,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","pt-5","PT-5","Privacy Notice",24,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Individuals must be given notice about the processing of their personally identifiable information that is available when they first interact with the organisation, clear and easy to understand, explains what is processed and why, and covers other defined information.\n\n**In practice.** For European organisations this aligns closely with GDPR transparency obligations in Articles 13 and 14. Good practice is layered privacy notices in plain language, presented at the point of data collection, kept consistent with the record of processing activities. Auditors look for the notices, version history and evidence that they match actual processing.\n\n**Common gaps.** Privacy notices often fall out of step with what systems actually do, especially after new tools or integrations are added. Notices written in legal language are hard for individuals to understand.","Provide notice to individuals about the processing of personally identifiable information that:\n  a. Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency];\n  b. Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;\n  c. Identifies the authority that authorizes the processing of personally identifiable information;\n  d. Identifies the purposes for which personally identifiable information is to be processed; and\n  e. Includes [Assignment: organization-defined information].\nDiscussion: Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices.\n\nPrivacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"croatian-gambling-operator-fined-259m-for-gdpr-consent-and-biometric-data-failures","Croatian Gambling Operator Fined €2.59M for GDPR Consent and Biometric Data Failures","2026-10-13T14:20:51.771+00:00",{"slug":25,"title":26,"published_at":27},"xandr-fined-85m-for-unlawful-processing-of-sensitive-grindr-user-data-in-real-time-bidding","Xandr Fined €8.5M for Unlawful Processing of Sensitive Grindr User Data in Real-Time Bidding","2026-10-13T14:20:35.881+00:00",{"slug":29,"title":30,"published_at":31},"google-fined-403m-for-opaque-location-data-practices-violating-gdpr","Google Fined €403M for Opaque Location Data Practices Violating GDPR","2026-09-23T10:21:30.394+00:00",{"slug":33,"title":34,"published_at":35},"dormeo-home-fined-for-ignoring-gdpr-opt-out-requests","Dormeo Home Fined for Ignoring GDPR Opt-Out Requests","2026-09-15T14:21:24.393+00:00",{"slug":37,"title":38,"published_at":39},"italian-publisher-fined-280k-for-marketing-emails-sent-without-valid-gdpr-consent","Italian Publisher Fined €280K for Marketing Emails Sent Without Valid GDPR Consent","2026-08-20T14:22:13.691+00:00",{"slug":41,"title":42,"published_at":43},"italian-dpa-fines-processor-15300-for-unsolicited-marketing-rights-failures-and-unauthorized-sub-pro","Italian DPA Fines Processor €15,300 for Unsolicited Marketing, Rights Failures, and Unauthorized Sub-Processing","2026-08-18T16:20:56.805+00:00",{"slug":45,"title":46,"published_at":47},"tim-fined-95m-for-unlawful-telemarketing-and-poor-sales-partner-oversight","TIM Fined €9.5M for Unlawful Telemarketing and Poor Sales Partner Oversight","2026-08-14T14:20:57.803+00:00",{"slug":49,"title":50,"published_at":51},"croatian-dpa-fines-zagrebaki-holding-25000-for-gdpr-transparency-and-identity-verification-failures","Croatian DPA Fines Zagrebački Holding €25,000 for GDPR Transparency and Identity Verification Failures","2026-08-14T10:21:01.387+00:00",{"slug":53,"title":54,"published_at":55},"spanish-solar-firm-fined-10000-for-unsolicited-marketing-calls-and-gdpr-consent-failures","Spanish Solar Firm Fined €10,000 for Unsolicited Marketing Calls and GDPR Consent Failures","2026-08-07T12:20:52.204+00:00",{"slug":57,"title":58,"published_at":59},"spanish-energy-firm-fined-10000-for-gdpr-consent-failures-in-third-party-marketing-data","Spanish Energy Firm Fined €10,000 for GDPR Consent Failures in Third-Party Marketing Data","2026-08-07T10:20:35.631+00:00",{"slug":61,"title":62,"published_at":63},"hungarian-online-store-fined-41500-for-gdpr-transparency-failures-1785925295811","Hungarian Online Store Fined €41,500 for GDPR Transparency Failures","2026-08-05T10:21:35.51+00:00",{"slug":65,"title":62,"published_at":66},"hungarian-online-store-fined-41500-for-gdpr-transparency-failures","2026-08-04T18:20:39.397+00:00",[68,73,78,83,88,92],{"slug":69,"name":70,"problem":71,"stories":72},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",10,{"slug":74,"name":75,"problem":76,"stories":77},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",3,{"slug":79,"name":80,"problem":81,"stories":82},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",2,{"slug":84,"name":85,"problem":86,"stories":87},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",1,{"slug":89,"name":90,"problem":91,"stories":87},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":93,"name":94,"problem":95,"stories":87},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[97,103,109,113,119,124,129,134],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","3","Control 3","Data Protection",23,{"family":104,"item":105,"code":106,"title":107,"together":108},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems",19,{"family":110,"item":111,"code":112,"title":112,"together":108},"itil","overview","ITIL",{"family":114,"item":115,"code":116,"title":117,"together":118},"gdpr","6","Article 6","Lawfulness of processing",16,{"family":5,"item":120,"code":121,"title":122,"together":123},"pt-2","PT-2","Authority to Process Personally Identifiable Information",15,{"family":114,"item":125,"code":126,"title":127,"together":128},"5","Article 5(1)(f)","Principles relating to processing of personal data",14,{"family":130,"item":111,"code":131,"title":132,"together":133},"nist-privacy","Privacy Framework","NIST Privacy Framework",13,{"family":114,"item":135,"code":136,"title":137,"together":138},"7","Article 7","Conditions for consent",12]