PM-21 Accounting of Disclosures

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Privacy	Organization	None

Related controls: AC-3, AU-2, PT-2

Control statement

• a. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
  • 1. Date, nature, and purpose of each disclosure; and
  • 2. Name and address, or other contact information of the individual or organization to which the disclosure was made;
• b. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
• c. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

NIST discussion

The purpose of accounting of disclosures is to allow individuals to learn to whom their personally identifiable information has been disclosed, to provide a basis for subsequently advising recipients of any corrected or disputed personally identifiable information, and to provide an audit trail for subsequent reviews of organizational compliance with conditions for disclosures. For federal agencies, keeping an accounting of disclosures is required by the PRIVACT ; agencies should consult with their senior agency official for privacy and legal counsel on this requirement and be aware of the statutory exceptions and OMB guidance relating to the provision.

Organizations can use any system for keeping notations of disclosures, if it can construct from such a system, a document listing of all disclosures along with the required information. Automated mechanisms can be used by organizations to determine when personally identifiable information is disclosed, including commercial services that provide notifications and alerts. Accounting of disclosures may also be used to help organizations verify compliance with applicable privacy statutes and policies governing the disclosure or dissemination of information and dissemination restrictions.

Assessment objectives (SP 800-53A)

Objectives and methods for PM-21

Determine if:

• PM-21a. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
  • PM-21a.01
    • PM-21a.01[01] the accounting includes the date of each disclosure;
    • PM-21a.01[02] the accounting includes the nature of each disclosure;
    • PM-21a.01[03] the accounting includes the purpose of each disclosure;
  • PM-21a.02
    • PM-21a.02[01] the accounting includes the name of the individual or organization to whom the disclosure was made;
    • PM-21a.02[02] the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
• PM-21b. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
• PM-21c. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

Examine: Privacy program plan; disclosure policies and procedures; records of disclosures; audit logs; Privacy Act policies and procedures; system of records notice; Privacy Act exemption rules..

Interview: Organizational personnel with privacy program responsibilities; organizational personnel with privacy responsibilities..

Test: Organizational processes for disclosures; mechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts..

Policy statement

• The Senior privacy official shall ensure an accurate accounting is kept of each disclosure of personally identifiable information, recording the date, nature and purpose of the disclosure. (PM-21a.1)
• The accounting shall record the name and address, or other contact information, of the individual or organization that received the disclosure. (PM-21a.2)
• The accounting shall be kept for as long as the personally identifiable information is maintained or five years after the disclosure, whichever is longer. (PM-21b)
• The Senior privacy official shall make the accounting available, on request, to the individual the information is about. (PM-21c)

Federal systems

For records in a Privacy Act system of records, 5 U.S.C. § 552a(c) sets this accounting. It excludes disclosures to agency employees who need the record for their duties (subsection (b)(1)) and disclosures the Freedom of Information Act requires (subsection (b)(2)). It does not require the accounting to be shown to the individual for law enforcement disclosures under subsection (b)(7).

• The Senior privacy official shall keep the accounting of disclosures from each system of records as 5 U.S.C. § 552a(c) requires. (PM-21)

From the Program Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

PM-21 asks you to keep an accurate accounting of each disclosure of personally identifiable information. Each entry records the date, nature and purpose of the disclosure, and the recipient’s name and address or other contact information (a). You keep the accounting for as long as the information is kept or five years after the disclosure, whichever is longer (b). You give individuals the accounting of disclosures about them when they ask (c). PM-21 is in the SP 800-53B Privacy baseline.

NIST’s PM-21 discussion gives three purposes. Individuals learn who received their information; the organization can tell recipients about later corrections or disputes; and reviewers have an audit trail of compliance with the conditions for disclosure. It also says any system for keeping notations will do, if it can produce a list of all disclosures with the required information. Automated mechanisms, including commercial notification and alert services, can detect when information is disclosed.

Common implementations. The Program Management policy gives PM-21 to the senior privacy official. The retention period in (b) is fixed by the control text, not a parameter. Most organizations keep the accounting in one of two ways:

Approach	Fits	Watch for
A central disclosure log the privacy office keeps	Disclosures made case by case, such as responses to requests from other organizations	Staff who disclose without logging; make the log part of the release procedure
Records the system produces for each transfer	Recurring or automated sharing, such as an interface to a partner	The log must name the individual’s records sent, not just that a file went out (AU-2)

Either way, keep the accounting searchable by individual, so a request under (c) can be answered quickly. The privacy impact assessment section 6 lists each recipient and purpose, which tells you which flows need an accounting. When a record is corrected under PM-22, the accounting shows who to notify.

Organization-defined parameters. PM-21 has none. Its clause leaves these choices open, with typical values your organization may set differently:

Choice	Typical value
Who keeps the accounting	The senior privacy official (the clause), with each system owner logging the system’s disclosures
Where it is kept	A central disclosure log, plus system records for automated sharing, searchable by individual
What the accounting does not cover	Use by the organization’s own staff who need the information for their duties, which audit logs record instead; federal agencies also apply the Privacy Act exclusions below
How fast a request under (c) is answered	Within 30 days of the request

Evidence assessors ask for.

• The disclosure procedure and the accounting itself
• A sample of disclosures traced to entries with the date, nature, purpose and recipient (a)
• Entries older than five years, to test retention (b)
• Records of individuals’ requests for the accounting and the responses (c)

Inheritance. PM-21 is implemented once, for the whole organization, and every system relies on it. NIST’s PM-1 discussion treats program management controls as independent of any system and distinct from common controls. Each system that discloses personally identifiable information records its disclosures in the organization’s accounting.

Common findings.

• Disclosures made by email or phone with no entry in the accounting.
• Automated interfaces logged as file transfers, with no way to tell whose records went where.
• Entries without a purpose or a recipient address.
• Accounting entries deleted with the system’s logs after a year.
• No procedure for an individual to ask for the accounting.

Enhancements. PM-21 has no enhancements.

Federal systems (as of October 2026). For each system of records, the Privacy Act requires an accurate accounting of the date, nature and purpose of each disclosure under subsection (b), and the recipient’s name and address (5 U.S.C. § 552a(c)). Disclosures to agency employees who need the record for their duties ((b)(1)) and disclosures the Freedom of Information Act requires ((b)(2)) are excluded. The accounting is kept “for at least five years or the life of the record, whichever is longer” (c)(2), and made available to the individual except for law enforcement disclosures under (b)(7) (c)(3). Under (c)(4), the agency informs past recipients of any correction or notation of dispute made under subsection (d).

Artifacts

• Program Management Decision Worksheet
• Program Management Policy