Personally Identifiable Information Processing and Transparency Decision Worksheet

Personally Identifiable Information Processing and Transparency Decision Worksheet template: Every decision the Personally Identifiable Information Processing and Transparency family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Personally Identifiable Information Processing and Transparency family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every PT control in the baseline, with a typical value where the Personally Identifiable Information Processing and Transparency Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Privacy	CSV

Decisions (Privacy baseline)

26 decisions.

Decision	Control	Typical value	Who decides
Where is the authority and purpose for each processing of personally identifiable information recorded, and who confirms it?	PT-2, PT-3	In each system’s privacy impact assessment; the privacy office confirms the authority with legal counsel before new processing begins.	Senior privacy official, with legal counsel
When does the organization rely on consent, and how is consent recorded and withdrawn?	PT-4	Consent where law requires it or where the processing is not needed to deliver what the individual asked for; opt-in, recorded with the date and notice version, and withdrawn as easily as it was given.	Senior privacy official
Where are privacy notices published, and who approves them and their changes?	PT-5, PT-5(2)	One privacy notice on the organization’s privacy page, with short notices at each point of collection that link to it; the privacy office approves every notice and change.	Senior privacy official
Which categories of personally identifiable information need specific processing conditions?	PT-7, PT-7(1), PT-7(2)	Social Security numbers, health, financial and biometric information, and information about children, plus a ban on records of how individuals exercise First Amendment rights.	Senior privacy official
Does the organization maintain Privacy Act systems of records or take part in matching programs?	PT-6, PT-8	Federal agencies, and contractors operating systems of records for them, yes, listed on the privacy page; other organizations record that PT-6, its enhancements, PT-5(2) and PT-8 do not apply.	Senior privacy official
Personnel or roles to whom the personally identifiable information processing and transparency policy is to be disseminated	PT-1	Everyone within its scope, through the policy library	Senior privacy official
Personnel or roles to whom the personally identifiable information processing and transparency procedures are to be disseminated	PT-1	The people who carry them out, and the system owners	Senior privacy official
Select one or more: organization-level; mission/business process-level; system-level	PT-1	Organization-level	Senior privacy official
An official to manage the personally identifiable information processing and transparency policy and procedures	PT-1	Senior privacy official	Senior privacy official
The frequency at which the current personally identifiable information processing and transparency policy is reviewed and updated	PT-1	Annually	Senior privacy official
Events that would require the current personally identifiable information processing and transparency policy to be reviewed and updated	PT-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Senior privacy official
The frequency at which the current personally identifiable information processing and transparency procedures are reviewed and updated	PT-1	Annually	Senior privacy official
Events that would require the personally identifiable information processing and transparency procedures to be reviewed and updated	PT-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Senior privacy official
The authority to permit the processing of personally identifiable information	PT-2	The law, regulation, contract or consent	Senior privacy official
The type of processing of personally identifiable information	PT-2	Each collection, use, sharing, retention and disposal	Senior privacy official
The type of processing of personally identifiable information to be restricted	PT-2	All processing	Senior privacy official
The purpose(s) for processing personally identifiable information	PT-3	The specific, explicit purposes of the system or program	Senior privacy official
The processing of personally identifiable information to be restricted	PT-3	All use, sharing and retention	Senior privacy official
Mechanisms to be implemented for ensuring any changes in the processing of personally identifiable information are made in accordance with requirements	PT-3	A privacy review of each proposed change through change control, with an updated privacy impact assessment (CM-3, CM-4, RA-8)	Senior privacy official
Requirements for changing the processing of personally identifiable information	PT-3	Approval by the senior privacy official, an updated privacy notice before the change takes effect, and the consent of individuals where the new purpose is not compatible with the original one	Senior privacy official
The tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information	PT-4	Opt-in consent forms and settings that record the date and the version of the notice shown, and let individuals withdraw consent as easily as they gave it	Senior privacy official
The frequency at which a notice is provided to individuals after initial interaction with an organization	PT-5	Each later collection of personally identifiable information, and whenever the notice changes materially	Senior privacy official
Information to be included with the notice about the processing of personally identifiable information	PT-5	What information is collected, with whom it is shared, the choices individuals have and how to exercise them, how individuals can access and correct their information, how long it is kept, how it is protected, and how to contact the privacy office	Senior privacy official
The frequency at which to review all routine uses published in the system of records notice	PT-6(1)	Annually	Senior privacy official
The frequency at which to review all Privacy Act exemptions claimed for the system of records	PT-6(2)	Annually	Senior privacy official
Processing conditions to be applied for specific categories of personally identifiable information	PT-7	The conditions the senior privacy official sets for each designated category, such as collection only where law requires it or a documented need exists, encryption, and access limited to named roles	Senior privacy official