PM-19 Privacy Program Leadership Role

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: PM-18, PM-20, PM-23, PM-24, PM-27

Control statement

Appoint a senior agency official for privacy with the authority, mission, accountability, and resources to coordinate, develop, and implement, applicable privacy requirements and manage privacy risks through the organization-wide privacy program.

NIST discussion

The privacy officer is an organizational official. For federal agencies—as defined by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines—this official is designated as the senior agency official for privacy. Organizations may also refer to this official as the chief privacy officer. The senior agency official for privacy also has roles on the data management board (see PM-23 ) and the data integrity board (see PM-24).

Assessment objectives (SP 800-53A)

Objectives and methods for PM-19

Determine if:

• PM-19[01] a senior agency official for privacy with authority, mission, accountability, and resources is appointed;
• PM-19[02] the senior agency official for privacy coordinates applicable privacy requirements;
• PM-19[03] the senior agency official for privacy develops applicable privacy requirements;
• PM-19[04] the senior agency official for privacy implements applicable privacy requirements;
• PM-19[05] the senior agency official for privacy manages privacy risks through the organization-wide privacy program.

Examine: Privacy program documents, including policies, procedures, plans, and reports; public privacy notices, including Federal Register notices; privacy impact assessments; privacy risk assessments; Privacy Act statements; system of records notices; computer matching agreements and notices; contracts, information sharing agreements, and memoranda of understanding; governing requirements, including laws, executive orders, regulations, standards, and guidance; other relevant documents or records.

Interview: Organizational personnel with privacy program planning and plan implementation responsibilities; organizational personnel with privacy responsibilities; senior agency official for privacy; privacy officials.

Policy statement

• The Senior leader shall appoint a Senior privacy official with the authority, mission, accountability and resources to coordinate, develop and implement applicable privacy requirements and manage privacy risk through the organization-wide privacy program. (PM-19)
• The Senior leader shall record the appointment in writing. (PM-19)

Federal systems

OMB Circular A-130 (July 28, 2016) requires each agency head to designate a Senior Agency Official for Privacy.

• The Senior privacy official shall be the Senior Agency Official for Privacy the agency head designates under OMB Circular A-130. (PM-19)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-19 asks you to appoint a senior official for privacy. The official needs the authority, mission, accountability and resources to coordinate, develop and implement privacy requirements, and to manage privacy risk through the organization-wide privacy program. PM-19 is in the SP 800-53B Privacy baseline.

NIST’s PM-19 discussion calls this official the privacy officer; federal agencies designate a senior agency official for privacy, and organizations may call the role chief privacy officer. The same official sits on the data governance body (PM-23) and the data integrity board (PM-24). The assessment objectives check each part: the appointment, and that the official coordinates, develops and implements privacy requirements and manages privacy risk.

Common implementations. The Program Management policy has the senior leader appoint the senior privacy official and record the appointment in writing. The roles table in section 3 of the Information Security Program Plan records the role, with the person in an appendix or roster. The privacy program plan (PM-18) describes the role and its staff.

A written appointment that would pass an assessment usually states:

• The official’s authority over privacy policy, compliance and privacy risk across the organization
• A reporting line high enough to reach the senior leader directly
• The staff and budget the privacy program has
• The official’s seats on governance bodies, such as the data governance body, the data integrity board and the team that handles breaches under the incident response plan (IR-8(1))
• The person who acts in the role when the official is absent or the post is vacant
• Which privacy functions the official may assign to other staff, with accountability kept by the official

Privacy and security need different skills. A small organization may give the role to its general counsel or compliance lead, as the PM policy’s decision questions note; give it to the Chief Information Security Officer only with that dual role recorded and the privacy work resourced.

Organization-defined parameters. PM-19 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who appoints the official	The senior leader (the clause)
How the appointment is recorded	A signed appointment letter or charter, kept with the program plan, and the role in the program plan’s roles table
Who fills the role	A senior privacy official who reports to the senior leader; in a small organization, the general counsel or compliance lead
When the appointment is reviewed	When the person in the role changes, and when the program plan is updated

Evidence assessors ask for.

• The signed appointment, with the authority, responsibilities and reporting line it gives
• The privacy program plan’s description of the role and its resources
• Records that show the official at work: privacy policies issued, privacy impact assessments reviewed, privacy risks decided
• Interviews with the official and the privacy staff

Inheritance. PM-19 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system names the privacy official in its privacy plan and routes privacy decisions to that office.

Common findings.

• A privacy official named on paper, with no staff or budget.
• An appointment that gives a title but no authority over privacy policy or risk.
• The role left vacant after the person leaves, with no acting official named.
• A privacy official left out of system authorizations and privacy impact assessments.

Enhancements. PM-19 has no enhancements.

Federal systems (as of October 2026). Executive Order 13719, section 3, says the head of each agency “shall designate or re-designate a Senior Agency Official for Privacy with the experience and skills necessary to manage an agency-wide privacy program.” OMB Circular A-130, main body section 5.f(1)(b) and its footnote 25, requires the SAOP and points to that order. Appendix II, section 4, gives the SAOP “a central policy-making role”.

OMB M-16-24 (September 15, 2016), Role and Designation of Senior Agency Officials for Privacy, sets position, expertise and authority requirements. The SAOP is a senior official at the Deputy Assistant Secretary or equivalent level, with roles in policy making, compliance and risk management. Agencies plan the resources the privacy program needs, and report the SAOP’s name and contact information to OMB, updating it when it changes. Other personnel may perform assigned privacy functions, but the SAOP keeps responsibility and accountability. The memorandum also says “privacy and security are independent and separate disciplines” that need different expertise. OMB’s FY 2026 SAOP FISMA Reporting Metrics (August 2026) cite both the order and M-16-24 for the SAOP questions.

Artifacts

• Program Management Decision Worksheet
• Program Management Policy