PRI-03.4: Data Fiduciary
Mechanisms exist to identify and appoint a Data Fiduciary, or equivalent role, that determines: (1) The purpose(s) for which Personal Data (PD) is necessary; (2) Authorized methods to collect, receive, process, store, transmit, share, update and/or dispose of PD; and (3) Authorized parties with whom PD may be shared.
Renumbered: Formerly PRI-01.8 in SCF 2025.4.
Code reused: In SCF 2025.4 and earlier, PRI-03.4 was Revoke Consent. That control is now PRI-24.3.
Control Question: Does the organization identify and appoint a Data Fiduciary, or equivalent role, that determines: (1) The purpose(s) for which Personal Data (PD) is necessary; (2) Authorized methods to collect, receive, process, store, transmit, share, update and/or dispose of PD; and (3) Authorized parties with whom PD may be shared?
General (1)
| Framework | Mapping Values |
|---|---|
| NIST Privacy Framework 1.0 | GV.PO-P3 |
APAC (1)
| Framework | Mapping Values |
|---|---|
| APAC India DPDPA 2023 | 5(3) 8(9) 8(10) 8(11) 10(2) 10(2)(a)(i) 10(2)(a)(ii) 10(2)(a)(iii) |
Capability Maturity Model
Level 0 — Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 — Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 — Planned & Tracked
SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 — Well Defined
Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners. ▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to appoint an individual to determine the following criteria about Personal Data (PD): (1) The purpose why PD is necessary; (2) Authorized methods to collect, receive, process, store, transmit, share, update and/or dispose PD; and (3) Authorized parties PD may be shared with.
Level 4 — Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 — Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Assessment Objectives
- PRI-03.4_A01 a Data Fiduciary, or equivalent role, is identified and appointed.
- PRI-03.4_A02 the purpose(s) for which Personal Data (PD) is necessary are determined by the Data Fiduciary, or equivalent role.
- PRI-03.4_A03 authorized methods to collect, receive, process, store, transmit, share, update and/or dispose of Personal Data (PD) are determined by the Data Fiduciary, or equivalent role.
- PRI-03.4_A04 authorized parties with whom Personal Data (PD) may be shared are determined by the Data Fiduciary, or equivalent role.
Technology Recommendations
Micro/Small
- Identify whether a data fiduciary (or equivalent) role is legally required; assign to owner if so
Small
- Designate a data fiduciary as required by applicable law
Medium
- Data fiduciary designation and responsibilities documentation
Large
- Formal data fiduciary program
- Designated fiduciary with documented responsibilities
Enterprise
- Enterprise data fiduciary framework
- Legal compliance program
- Data fiduciary accountability measures