Assessment Objective
Determine if:
- PT-05a.
- PT-05a.[01] a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;
- PT-05a.[02] a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [Assignment: frequency];
- PT-05b. a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;
- PT-05c. a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;
- PT-05d. a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;
- PT-05e. a notice to individuals about the processing of personally identifiable information which includes [Assignment: information] is provided.
Assessment Methods
Examine
- Personally identifiable information processing and transparency policy and procedures
- privacy notice
- Privacy Act statements
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personally identifiable information processing and transparency responsibilities
- organizational personnel with user interface or user experience responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | PT-05 Privacy Notice |