Guidance, practices and programmes
NIST Privacy Framework
A voluntary framework for managing privacy risk.
Official source Published by US National Institute of Standards and Technology. US government work in the public domain.
What it is
The NIST Privacy Framework is a voluntary tool for identifying and managing privacy risk arising from data processing. It complements the Cybersecurity Framework by covering privacy problems that are not caused by security incidents, such as excessive data collection or unexpected use.
Who it applies to
- Organisations of any size that want a structured privacy risk programme
- Privacy and data protection teams working with security teams on shared controls
- Organisations subject to GDPR that want an engineering oriented structure alongside legal requirements
- Product and engineering teams designing privacy into systems
- Status
- A voluntary framework. Version 1.0 was published in January 2020, and NIST released a draft version 1.1 in 2025 to align it with CSF 2.0.
- Enforcement
- Voluntary, with no certification or enforcement. It does not by itself demonstrate compliance with GDPR or other privacy laws, but can be used to structure and evidence that work.
Key points
- Privacy risk includes harm to individuals from legitimate processing, not only from breaches
- Several functions overlap with CSF, so security and privacy work can share a structure
- Data inventory and mapping is the foundation for most other outcomes
- Communicate-P covers transparency and how individuals and partners are informed
- It is technology neutral and law neutral, so legal requirements still need to be mapped on top
Where to start
- 1Build or update an inventory of personal data processing
- 2Create a current profile against the Privacy Framework core
- 3Agree a target profile that reflects GDPR and other legal duties
- 4Plan improvements jointly with the security team using the shared CSF structure
How it is structured
| Core functions | Identify-P, Govern-P, Control-P, Communicate-P and Protect-P |
|---|---|
| Categories and subcategories | Specific privacy outcomes under each function |
| Profiles | Current and target profiles to plan improvements |
| Implementation tiers | How well privacy risk management is integrated in the organisation |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.