Control statement
Provide notice to individuals about the processing of personally identifiable information that:
- a.Is available to individuals upon first interacting with an organization, and subsequently at [Organization-defined: frequency];
- b.Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
- c.Identifies the authority that authorizes the processing of personally identifiable information;
- d.Identifies the purposes for which personally identifiable information is to be processed; and
- e.Includes [Organization-defined: information].
Discussion
Privacy notices help inform individuals about how their personally identifiable information is being processed by the system or organization. Organizations use privacy notices to inform individuals about how, under what authority, and for what purpose their personally identifiable information is processed, as well as other information such as choices individuals might have with respect to that processing and other parties with whom information is shared. Laws, executive orders, directives, regulations, or policies may require that privacy notices include specific elements or be provided in specific formats. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding when and where to provide privacy notices, as well as elements to include in privacy notices and required formats. In circumstances where laws or government-wide policies do not require privacy notices, organizational policies and determinations may require privacy notices and may serve as a source of the elements to include in privacy notices. Privacy risk assessments identify the privacy risks associated with the processing of personally identifiable information and may help organizations determine appropriate elements to include in a privacy notice to manage such risks. To help individuals understand how their information is being processed, organizations write materials in plain language and avoid technical jargon.
Organization-defined parameters
These values must be resolved through the organization’s tailoring and governance process. Bracketed parameter references in the control text identify where a decision is required.
From control text to operational evidence
Use Privacy Notice as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to privacy authority, purpose, transparency, consent, individual rights, and data-processing governance.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- privacy notices and consent records
- authority and purpose documentation
- data-processing inventories
- individual request and redress records
Common failure patterns
- collection justified by convenience rather than authority
- notices do not reflect actual processing
- secondary use expands without review
- retention and deletion commitments not enforced
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- PT-05a.
- PT-05a.[01]a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;
- PT-05a.[02]a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [Organization-defined: frequency];
- PT-05b.a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;
- PT-05c.a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;
- PT-05d.a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;
- PT-05e.a notice to individuals about the processing of personally identifiable information which includes [Organization-defined: information] is provided.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act statements
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
PT-5(1) — Just-in-time Notice
Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action, or [Organization-defined: frequency].
Official discussion
Just-in-time notices inform individuals of how organizations process their personally identifiable information at a time when such notices may be most useful to the individuals. Individual assumptions about how personally identifiable information will be processed might not be accurate or reliable if time has passed since the organization last presented notice or the circumstances under which the individual was last provided notice have changed. A just-in-time notice can explain data actions that organizations have identified as potentially giving rise to greater privacy risk for individuals. Organizations can use a just-in-time notice to update or remind individuals about specific data actions as they occur or highlight specific changes that occurred since last presenting notice. A just-in-time notice can be used in conjunction with just-in-time consent to explain what will occur if consent is declined. Organizations use discretion to determine when to use a just-in-time notice and may use supporting information on user demographics, focus groups, or surveys to learn about users’ privacy interests and concerns.
Organization-defined parameters (1)
Assessment objectives and methods
a notice of personally identifiable information processing is presented to individuals at a time and location where the individual provides personally identifiable information, in conjunction with a data action, or [Organization-defined: frequency].
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information
Related controls
PT-5(2) — Privacy Act Statements
Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.
Official discussion
If a federal agency asks individuals to supply information that will become part of a system of records, the agency is required to provide a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statement on the form used to collect the information or on a separate form that can be retained by the individual. The agency provides a [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statement in such circumstances regardless of whether the information will be collected on a paper or electronic form, on a website, on a mobile application, over the telephone, or through some other medium. This requirement ensures that the individual is provided with sufficient information about the request for information to make an informed decision on whether or not to respond. [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements provide formal notice to individuals of the authority that authorizes the solicitation of the information; whether providing the information is mandatory or voluntary; the principal purpose(s) for which the information is to be used; the published routine uses to which the information is subject; the effects on the individual, if any, of not providing all or any part of the information requested; and an appropriate citation and link to the relevant system of records notice. Federal agency personnel consult with the senior agency official for privacy and legal counsel regarding the notice provisions of the [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455).
Assessment objectives and methods
Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act system of records
- forms that include Privacy Act statements
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for including Privacy Act statements on forms that collect information or on separate forms that can be retained by individuals
Related controls
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.