PM-19—Privacy Program Leadership Role
PRIVACY
>Control Description
Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.
>Cross-Framework Mappings
>Supplemental Guidance
The privacy officer is an organizational official. For federal agencies--as defined by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines--this official is designated as the senior agency official for privacy. Organizations may also refer to this official as the chief privacy officer.
The senior agency official for privacy also has roles on the data management board (see PM-23) and the data integrity board (see PM-24).
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern the designation of a senior privacy official?
- •What are the responsibilities and authorities of the senior privacy official?
- •How does the senior privacy official coordinate with security, legal, and other organizational functions?
- •How does the senior privacy official report to senior leadership on privacy risks and posture?
- •What governance exists for ensuring the senior privacy official has adequate resources and independence?
Technical Implementation:
- •What systems and data does the senior privacy official access for oversight?
- •How does the senior privacy official monitor privacy compliance and risks?
- •What reporting tools support senior privacy official responsibilities?
Evidence & Documentation:
- •Provide documentation designating the senior privacy official and defining responsibilities.
- •Provide evidence of senior privacy official reporting to senior leadership.
- •Provide privacy posture reports prepared by the senior privacy official.
- •Provide records of coordination between privacy, security, and legal functions.
Ask AI
Configure your API key to use AI features.