CCI-004571

Provide notice to individuals about the processing of personally identifiable information that is available to individuals upon first interacting with an organization, and subsequently at an organization-defined frequency.

Implementation Guidance

Determine if: - a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization. - a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [PT-05_ODP[01]; the frequency at which a notice is provided to individuals after initial interaction with an organization is defined].

Validation Procedures

Examine: [SELECT FROM: Personally identifiable information processing and transparency policy and procedures; privacy notice; Privacy Act statements; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with user interface or user experience responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information].

The controls below (if any) were marked by NIST as being related to CCI-004571.