PT-3—Personally Identifiable Information Processing Purposes
>Control Description
Identify and document the ⚙organization-defined purpose(s) for processing personally identifiable information;
Describe the purpose(s) in the public privacy notices and policies of the organization;
Restrict the ⚙organization-defined processing of personally identifiable information to only that which is compatible with the identified purpose(s); and
Monitor changes in processing personally identifiable information and implement ⚙organization-defined mechanisms to ensure that any changes are made in accordance with ⚙organization-defined requirements.
>Control Enhancements(2)
>Cross-Framework Mappings
>Supplemental Guidance
Identifying and documenting the purpose for processing provides organizations with a basis for understanding why personally identifiable information may be processed. The term process includes every step of the information life cycle, including creation, collection, use, processing, storage, maintenance, dissemination, disclosure, and disposal. Identifying and documenting the purpose of processing is a prerequisite to enabling owners and operators of the system and individuals whose information is processed by the system to understand how the information will be processed.
This enables individuals to make informed decisions about their engagement with information systems and organizations and to manage their privacy interests. Once the specific processing purpose has been identified, the purpose is described in the organization's privacy notices, policies, and any related privacy compliance documentation, including privacy impact assessments, system of records notices, PRIVACT statements, computer matching notices, and other applicable Federal Register notices.Organizations take steps to help ensure that personally identifiable information is processed only for identified purposes, including training organizational personnel and monitoring and auditing organizational processing of personally identifiable information.Organizations monitor for changes in personally identifiable information processing. Organizational personnel consult with the senior agency official for privacy and legal counsel to ensure that any new purposes that arise from changes in processing are compatible with the purpose for which the information was collected, or if the new purpose is not compatible, implement mechanisms in accordance with defined requirements to allow for the new processing, if appropriate.
Mechanisms may include obtaining consent from individuals, revising privacy policies, or other measures to manage privacy risks that arise from changes in personally identifiable information processing purposes.
>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What is the process for determining and documenting the purpose for collecting and using PII?
- •How does the organization ensure PII is only used for authorized purposes?
- •Who reviews and approves PII collection and use purposes?
- •What controls prevent PII from being used for incompatible purposes?
- •What governance exists for monitoring PII use and preventing unauthorized secondary uses?
Technical Implementation:
- •What data governance tools document PII collection and use purposes?
- •How are purpose limitations technically enforced in systems?
- •What controls prevent PII from being used for incompatible purposes?
- •How is purpose information integrated with access controls and data flows?
- •What monitoring detects when PII is used outside documented purposes?
Evidence & Documentation:
- •Provide documentation of purposes for collecting and using PII in each system.
- •Provide evidence that PII use is limited to documented purposes.
- •Provide purpose specification in privacy notices and SORNs.
- •Provide records of purpose review and approval.
- •Provide audit logs or controls preventing incompatible PII uses.
Ask AI
Configure your API key to use AI features.