NIST 800-53 rev.5/Personally Identifiable Information Processing and Transparency/600 of 1011
PT-03Personally Identifiable Information Processing Purposes
Control family: Personally Identifiable Information Processing and Transparency
Control description
a. Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information;
b. Describe the purpose(s) in the public privacy notices and policies of the organization;
c. Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and
d. Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].