What it covers. The NIST Privacy Framework is voluntary guidance for managing privacy risk arising from data processing. Version 1.0 is organised into five functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P, with categories and subcategories beneath them. It is designed to sit alongside the NIST Cybersecurity Framework and supports building profiles of current and target state.
In practice. Organisations map their data processing, identify privacy risks to individuals and choose outcomes from the framework that fit their context and legal obligations. A current and target profile helps prioritise improvement. Evidence includes data inventories, privacy risk assessments, policies on data handling, transparency material and records showing how individuals' requests are handled. In Europe it is often used as a structuring aid alongside GDPR rather than instead of it.
Common gaps. Privacy risk is often assessed only as a compliance or security question, without considering harms to individuals. Profiles are created once and not maintained.