Skip to main content

PRI-29: Usage Restrictions of Personal Data (PD)

PRI 8 — High Identify

Mechanisms exist to restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to: (1) The purpose(s) originally collected, consistent with the data privacy notice(s); (2) What is authorized by the data subject, or authorized agent; and (3) What is consistent with applicable laws, regulations and contractual obligations.

Renumbered: Formerly PRI-05.4 in SCF 2025.4.

Control Question: Does the organization restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to: (1) The purpose(s) originally collected, consistent with the data privacy notice(s); (2) What is authorized by the data subject, or authorized agent; and (3) What is consistent with applicable laws, regulations and contractual obligations?

General (27)
Framework Mapping Values
AICPA Privacy Management Framework (PMF) M1.0-POF3 U4.1 U4.1-POF1 Q8.1-POF3
AICPA TSC 2017:2022 (used for SOC 2) (source) P4.0 P4.1 P4.1-POF1
CSA CCM 4.1.0 DSP-12 DSP-17
ISO 27002 2022 5.33
ISO 27017 2015 18.1.4
ISO 27018 2025 5.33
ISO 29100 2024 6.6
NIST AI 100-1 (AI RMF) 1.0 MAP 1.6
NIST 800-53 R4 DM-3(1) UL-1
NIST 800-53 R5.2 AC-23 PM-25 PT-02 PT-07
NIST 800-53B R5 (privacy) (source) PM-25 PT-02 PT-07
NIST 800-82 R3 AC-23 PM-25 PT-02 PT-07
NIST 800-82 R3 LOW OT Overlay PM-25
NIST 800-82 R3 MODERATE OT Overlay PM-25
NIST 800-82 R3 HIGH OT Overlay PM-25
NIST 800-160 Vol2 R1 AC-23
NIST 800-161 R1 AC-23 PM-25
NIST 800-161 R1 Flow Down AC-23
NIST 800-161 R1 Level 2 AC-23 PM-25
NIST 800-161 R1 Level 3 AC-23
NIST Privacy Framework 1.0 CT.PO-P1 CT.PO-P2
OECD Privacy Principles 4
PCI DSS 4.0.1 (source) 6.5.5
PCI DSS 4.0.1 SAQ D Merchant (source) 6.5.5
PCI DSS 4.0.1 SAQ D Service Provider (source) 6.5.5
SCF DPMP 2026 3.3
Shared Assessments SIG 2025 P.2.3
US (15)
Framework Mapping Values
USA Federal CMS MARS-E 2.0 UL-1
USA Federal Data Privacy Framework 2023 II.2.c
USA Federal CJIS Security Policy 6.0 4.2.2 4.2.3.1 4.2.3.2 4.3
USA Federal 45 CFR 155.260 155.260(a)(3)(v)
USA Federal IRS 1075 2021 PT-2
USA Federal HIPAA Administrative Simplification 2013 § 164.502(c) § 164.502(d)(1) § 164.504(g)(2) § 164.506(a) § 164.506(c)(1) § 164.506(c)(5) § 164.508(a)(1) § 164.508(a)(2)(i)(C) § 164.510(a)(1)(i)(A) § 164.510(a)(1)(i)(B) § 164.510(a)(1)(i)(C) § 164.510(a)(1)(i)(D) § 164.510(a)(1)(ii)(A) § 164.510(a)(1)(ii)(B) § 164.510(b)(4) § 164.512 § 164.512(i)(1) § 164.512(j)(1) § 164.512(j)(1)(i)(A) § 164.512(j)(1)(i)(B) § 164.512(j)(1)(ii) § 164.512(j)(1)(ii)(A) § 164.512(j)(1)(ii)(B) § 164.512(j)(2)(i) § 164.512(j)(2)(ii) § 164.512(j)(3) § 164.512(j)(4) § 164.512(k)(1)(i) § 164.512(k)(1)(i)(A) § 164.512(k)(1)(i)(B) § 164.512(k)(1)(ii) § 164.512(k)(1)(iii) § 164.512(k)(1)(iv) § 164.512(k)(2) § 164.512(k)(3) § 164.512(k)(4) § 164.512(k)(4)(i) § 164.512(k)(4)(ii) § 164.512(k)(4)(iii) § 164.512(k)(5)(i) § 164.512(k)(5)(i)(A) § 164.512(k)(5)(i)(B) § 164.512(k)(5)(i)(C) § 164.512(k)(5)(i)(D) § 164.512(k)(5)(i)(E) § 164.512(k)(5)(i)(F) § 164.512(k)(5)(ii) § 164.512(k)(5)(iii) § 164.512(k)(6)(i) § 164.512(k)(6)(ii) § 164.512(k)(6)(ii)(1) § 164.514(f)(2)(i) § 164.514(g) § 164.530(i)(4)(ii) § 164.530(i)(4)(ii)(B) § 164.532(a) § 164.532(b) § 164.532(c)
USA Federal FIPPS 1973 4.0
USA California CCPA 2025 7023(d)(3) 7026(f) 7026(f)(1) 7027(a)
USA Montana CDPA 2025 30-14-2808(4)(e) 30-14-2811(2)(a)(ii) 30-14-2812(2)(a)
USA Nevada SB220 2019 2.3
USA Oregon CPA 2023 Section 4(7)(b) Section 5(2)(a) Section 5(2)(c)
USA Tennessee TIPA 2025 47-18-3203(a)(2)(C)(i)(b) 47-18-3203(a)(2)(C)(ii) 47-18-3204(a)(6) 47-18-3207(b) 47-18-3207(c) 47-18-3207(d)
USA Texas BC521 2009 521.051(a)
USA Texas CDPA 2025 541.052(f)(2) 541.204(a) 541.204(a)(1) 541.204(a)(2) 541.204(b)
USA Virginia CDPA 2023 59.1-577.1.C 59.1-578.A.2 59.1-578.F.1.c
EMEA (18)
Framework Mapping Values
EMEA Austria FAPPD 2000 § 7(1) § 7(6) § 38 § 39 § 40(1) § 40(2) § 40(3)
EMEA Belgium Act 8 1992 Title 1, Chapter II, Art. 8(3) Title 1, Chapter II, Art. 9 Title 1, Chapter II, Art. 10(1) Title 2, Chapter III, Art. 45(2)
EMEA Germany FDPA 2017 2.1.1.22(1) 2.1.1.22(1)1 2.1.1.22(1)1(a) 2.1.1.22(1)1(b) 2.1.1.22(1)1(c) 2.1.1.22(1)1(d) 2.1.1.22(1)2(a) 2.1.1.22(1)2(b) 2.1.1.22(2) 2.1.1.22(2)1 2.1.1.22(2)2 2.1.1.22(2)3 2.1.1.22(2)8 2.1.1.22(2)9 2.1.1.22(2)10 2.1.1.24(1) 2.1.1.24(1)1 2.1.1.24(1)2 2.1.1.24(2) 2.2.33(1)2(a) 2.2.33(1)3(b) 3.2.52
EMEA EU AI Act Article 10.5(c) Article 10.5(d)
EMEA UK DPA 2018 Section 44(4) Section 44(4)(a) Section 44(4)(b) Section 44(4)(c) Section 44(4)(e) Section 47(4)
EMEA Greece PIRPPD 1997 B.7.1 B.7.2 B.8.3
EMEA Hungary Act CXII 2011 II.11.12(3)(a) II.11.12(3)(b) II.12.13(2)
EMEA Ireland DPA 2018 s.45 s.46 s.47 s.48 s.49 s.50 s.51 s.52 s.53 s.54 s.55 s.73
EMEA Italy PDPC 2018 Article 2-f(1) Article 2-g(1) Article 101(1) Article 101(2) Article 101(3) Article 122(1)
EMEA Kenya DPA 2019 IV.25(a) IV.25(b) IV.28(3) IV.30(1) IV.30(1)(a) IV.30(1)(b) IV.30(1)(b)(i) IV.30(1)(b)(ii) IV.30(1)(b)(iii) IV.30(1)(b)(iv) IV.30(1)(b)(v) IV.30(1)(b)(vi) IV.30(1)(b)(vii) IV.30(2) IV.33(1) IV.33(1)(a) IV.33(1)(b) IV.36 V.45 V.45(a) V.45(a)(i) V.45(a)(ii) V.45(b) V.45(c) V.45(c)(i) V.45(c)(ii) V.45(c)(iii) V.46(1) V.46(1)(a) V.46(1)(b) V.46(2)(a) V.46(2)(b)
EMEA Nigeria DPR 2019 2.1(1)(a) 2.1(1)(a)(i) 2.1(1)(a)(ii) 2.1(1)(b) 2.1(1)(c) 2.2(a) 2.2(c) 2.2(d) 2.2(e) 3.1(12)
EMEA Norway DPA 2018 9 12
EMEA Qatar PDPPL 2020 3.10 4.16 4.17 4.17.4
EMEA Russia 152-FZ 2025 Art. 10 Art. 11 Art. 13
EMEA Saudi Arabia PDPL Article 11.3
EMEA Serbia 87/2018 II.6(1) II.6(2) II.6(3) II.6(4) II.6(5) II.7 II.7(1) II.7(2) II.12 II.12(1) II.12(2) II.12(3) II.12(4) II.12(5) II.12(6) II.13 II.17 II.17(1) II.17(2) II.17(3) II.17(4) II.17(5) II.17(6) II.17(7) II.17(8) II.17(9) II.17(10) II.18 II.18(1) II.18(2) II.18(3) II.19 II.20 IV.1.46 IV.1.47-1 IV.1.47-1(1) IV.1.47-1(2) IV.1.47-1(3) IV.1.47-1(4) IV.1.47-1(5) IV.1.47-1(6) IV.1.47-1(7)
EMEA Turkey LDDP 2016 4(1) 4(2) 4(2)(a) 4(2)(b) 4(2)(c) 4(2)(ç) 4(2)(d) 5(1) 5(2) 5(2)(a) 5(2)(b) 5(2)(c) 5(2)(ç) 5(2)(d) 5(2)(e) 5(2)(f) 6(1) 6(2) 6(3) 6(3)(a) 6(3)(b) 6(3)(c) 6(3)(ç) 6(3)(d) 6(3)(e) 6(3)(f) 6(3)(g) 6(4) 7(1) 7(2) 7(3)
EMEA South Africa POPIA 2013 3.A.4.15(1) 3.A.4.15(2) 3.A.4.15(2)(a) 3.A.4.15(2)(b) 3.A.4.15(2)(c) 3.A.4.15(2)(d) 3.A.4.15(2)(e) 3.A.4.15(3) 3.A.4.15(3)(a) 3.A.4.15(3)(b) 3.A.4.15(3)(c) 3.A.4.15(3)(c)(i) 3.A.4.15(3)(c)(ii) 3.A.4.15(3)(c)(iii) 3.A.4.15(3)(c)(iv) 3.A.4.15(3)(d) 3.A.4.15(3)(d)(i) 3.A.4.15(3)(d)(ii) 3.A.4.15(3)(e) 3.A.4.15(3)(f) 3.B.26(1) 3.B.26(1)(a) 3.B.26(1)(b) 3.B.26(1)(b)(i) 3.B.26(1)(b)(ii) 3.B.27(1) 3.B.27(1)(a) 3.B.27(1)(b) 3.B.27(1)(c) 3.B.27(1)(d) 3.B.27(1)(d)(i) 3.B.27(1)(d)(ii) 3.B.27(1)(e) 3.B.27(1)(f) 3.B.27(2) 3.B.27(3)
APAC (13)
Framework Mapping Values
APAC Australian Privacy Principles 2026 2.3.3 2.3.3.a 2.3.3.a.i 2.3.3.a.ii 2.3.3.b 2.3.4 2.3.4.a 2.3.4.b 2.3.4.c 2.3.4.d 2.3.4.d.i 2.3.4.d.ii 2.3.4.e 2.3.4.e.i 2.3.4.e.ii 3.6.1 3.6.1.a 3.6.1.b 3.6.2 3.6.2.a 3.6.2.a.i 3.6.2.a.ii 3.6.2.b 3.6.2.c 3.6.2.d 3.6.2.e 3.6.3 3.6.4 3.6.4.a 3.6.4.b 3.7.1 3.7.2 3.7.2.a 3.7.2.b 3.7.2.c 3.7.2.d 3.7.3 3.7.3.a 3.7.3.a.i 3.7.3.a.ii 3.7.3.b 3.7.3.b.i 3.7.3.b.ii 3.7.3.c 3.7.3.d 3.7.3.d.i 3.7.3.d.ii 3.7.3.e 3.7.4 3.7.5 3.7.5.a 3.7.5.b 3.7.5.c
APAC China DNSIP 2012 V
APAC China Cybersecurity Law 2017 Article 41 Article 44
APAC China Privacy Law 2021 Article 13 Article 28
APAC Hong Kong PDO 2022 35K(1) 35K(1)(a) 35K(1)(b) 35K(1)(c) 35K(2) 35K(2)(a) 35K(2)(b) 35K(2)(c) 35K(3) Schedule 1 - 3(1) Schedule 1 - 3(2) Schedule 1 - 3(2)(a) Schedule 1 - 3(2)(a)(i) Schedule 1 - 3(2)(a)(ii) Schedule 1 - 3(2)(a)(iii) Schedule 1 - 3(2)(b) Schedule 1 - 3(2)(c) Schedule 1 - 3(3)
APAC India DPDPA 2023 7(f) 7(g) 7(h) 7(i) 8(1)
APAC Japan APPI 2020 IV.1.16(1) IV.1.17(2) IV.1.17(2)(i) IV.1.17(2)(ii) IV.1.17(2)(iii) IV.1.17(2)(iv) IV.1.17(2)(v) IV.1.17(2)(vi) IV.1.23(1)(i) IV.1.23(1)(ii) IV.1.23(1)(iii) IV.1.23(1)(iv)
APAC South Korea PIPA 2011 III.1.18(1) III.1.18(2) III.1.18(2)1 III.1.18(2)2 III.1.18(2)3 III.1.18(2)4 III.1.18(2)5 III.1.18(2)6 III.1.18(2)7 III.1.18(2)8 III.1.18(2)9 III.1.19 III.1.19.1 III.1.19.2 III.2.23.1 III.2.23.2
APAC Malaysia PDPA 2010 6(1)(a) 6(2) 6(2)(a) 6(2)(b) 6(2)(c) 6(2)(d) 6(2)(e) 6(2)(f) 6(3) 6(3)(a) 6(3)(b) 6(3)(c) 8 8(a) 8(a)(i) 8(a)(ii) 8(b) 39 39(a) 39(b) 39(b)(i) 39(b)(ii) 39(c) 39(d) 39(e) 40(1) 40(1)(a) 40(1)(b) 40(1)(b)(i) 40(1)(b)(ii) 40(1)(b)(ii)(A) 40(1)(b)(ii)(B) 40(1)(b)(iii) 40(1)(b)(iv) 40(1)(b)(iv)(A) 40(1)(b)(iv)(B) 40(1)(b)(v) 40(1)(b)(vi) 40(1)(b)(vii) 40(1)(b)(viii) 40(1)(b)(ix) 40(1)(b)(x) 40(1)(c) 42(1)(b) 42(1)(b)(A) 42(1)(b)(B) 42(2) 42(2)(a) 42(2)(b) 42(2)(b)(i) 42(2)(b)(ii) 42(2)(b)(iii) 42(2)(b)(iv) 42(2)(c) 42(3) 42(3)(a) 42(3)(b) 42(4) 42(5)
APAC New Zealand Privacy Act of 2020 3.1.22.1(1) 3.1.22.1(1)(a) 3.1.22.1(1)(b) 3.1.22.10(1) 3.1.22.10(1)(a) 3.1.22.10(1)(b) 3.1.22.10(1)(b)(i) 3.1.22.10(1)(b)(ii) 3.1.22.10(1)(c) 3.1.22.10(1)(d) 3.1.22.10(1)(e) 3.1.22.10(1)(e)(i) 3.1.22.10(1)(e)(ii) 3.1.22.10(1)(e)(iii) 3.1.22.10(1)(e)(iv) 3.1.22.10(1)(f) 3.1.22.10(1)(f)(i) 3.1.22.10(1)(f)(ii)
APAC Philippines DPA 2012 III.11(a) III.11(c) III.12(b) III.12(c) III.12(d) III.12(e) III.12(f) III.13 III.13(a) III.13(b) III.13(c) III.13(d) III.13(e) III.13(f)
APAC Singapore PDPA 2012 4.1.13 4.1.13(a) 4.1.13(b) 4.1.15(3)(a) 4.1.15(3)(b) 4.1.15(3)(c) 4.1.17(1)(b) 4.1.17(2)(a)
APAC Taiwan PDPA 2025 I.6 I.6.1 I.6.2 I.6.3 I.6.4 I.6.5 I.6.6 III.19 III.19.1 III.19.2 III.19.3 III.19.4 III.19.5 III.19.6 III.19.7 III.19.8 III.20 III.20.1 III.20.2 III.20.3 III.20.4 III.20.5 III.20.6 III.20.7
Americas (6)
Framework Mapping Values
Americas Bahamas DPA 2003 IV.29(2) IV.29(2)(a) IV.29(2)(b) IV.29(2)(c) IV.29(2)(d) IV.34(1) IV.34(2) IV.34(2)(a) IV.34(2)(b) IV.34(2)(c) IV.34(2)(d) IV.34(2)(e) IV.34(2)(e)(i) IV.34(2)(e)(ii) IV.34(2)(f) IV.34(2)(g) IV.34(2)(h) IV.34(2)(i) IV.34(2)(j) IV.34(2)(k) IV.34(2)(l) IV.34(2)(m) IV.34(2)(n) IV.34(2)(n)(i) IV.34(2)(n)(ii) IV.34(2)(n)(iii) IV.34(2)(n)(iv) IV.34(2)(o) IV.34(2)(o)(a) IV.34(2)(o)(b) IV.34(2)(p) IV.34(2)(p)(i) IV.34(2)(p)(ii) IV.34(2)(p)(ii)(aa) IV.34(2)(p)(ii)(bb) IV.34(2)(p)(ii)(cc) IV.34(2)(p)(ii)(dd) IV.34(2)(p)(ii)(ee) IV.34(2)(p)(iii) IV.34(2)(q) IV.34(2)(q)(i) IV.34(2)(q)(ii) IV.34(2)(q)(iii) IV.34(2)(r) IV.34(2)(s) IV.34(4) IV.34(4)(a) IV.34(4)(b) IV.34(5) IV.34(5)(a) IV.34(5)(b) IV.34(5)(c) IV.34(5)(d) IV.34(6)
Americas Brazil LGPD 2018 II.I.7.II II.I.7.III II.I.7.V II.I.7.VI II.I.7.VII II.I.7.VIII II.I.7.IX II.I.7.X II.I.7.X.1 II.I.7.X.2 II.I.7.X.3 II.I.7.X.4 II.I.7.X.5 II.I.7.X.6
Americas Canada PIPEDA 2000 P5-4.5 P5-4.5.3
Americas Chile Act 19628 1999 I.6 I.10 II.15
Americas Colombia Law 1581 2012 II.4(f) III.6 III.6(a) III.6(b) III.6(c) III.6(d) III.6(e) III.7
Americas Mexico FDPA 2010 II.7 II.13 V.37 V.37.I V.37.II V.37.III V.37.IV V.37.V V.37.VI V.37.VII

Capability Maturity Model

Level 0 — Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 — Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 — Planned & Tracked

SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).

Level 3 — Well Defined

Privacy (PRI) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with PRI domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with PRI domain capabilities are well-documented and kept current by process owners. ▪ A data privacy team, or similar function, is appropriately staffed and supported to implement and maintain PRI domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of data privacy operations (e.g., privacy notice management software and customer management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with PRI domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to restrict collecting, receiving, processing, storing, transmitting, sharing and/or updating Personal Data (PD) to: (1) The purpose(s) originally collected, consistent with the data privacy notice(s); (2) What is authorized by the data subject, or authorized agent; and (3) What is consistent with applicable laws, regulations and contractual obligations.

Level 4 — Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 — Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

Assessment Objectives

  1. PRI-29_A01 the authority to permit the processing of Personal Data (PD) is defined.
  2. PRI-29_A02 the type of processing of Personal Data (PD) is defined.
  3. PRI-29_A03 the type of processing of Personal Data (PD) to be restricted is defined.
  4. PRI-29_A04 the authority that permits the processing of Personal Data (PD) is determined and documented.
  5. PRI-29_A05 the processing of Personal Data (PD) is restricted to only that which is authorized.
  6. PRI-29_A06 processing conditions to be applied for specific categories of Personal Data (PD) are defined.
  7. PRI-29_A07 processing conditions are applied for specific categories of Personal Data (PD).
  8. PRI-29_A08 data mining prevention and detection techniques are defined.
  9. PRI-29_A09 data storage objects to be protected against unauthorized data mining are defined.
  10. PRI-29_A10 organization-defined techniques are employed for organization-defined data storage objects to detect and protect against unauthorized data mining.
  11. PRI-29_A11 the frequency for reviewing policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
  12. PRI-29_A12 the frequency for updating policies that address the use of Personal Data (PD) for internal testing, training and research is defined.
  13. PRI-29_A13 the frequency for reviewing procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
  14. PRI-29_A14 the frequency for updating procedures that address the use of Personal Data (PD) for internal testing, training and research is defined.
  15. PRI-29_A15 policies that address the use of Personal Data (PD) for internal testing are developed and documented.
  16. PRI-29_A16 policies that address the use of Personal Data (PD) for internal training are developed and documented.
  17. PRI-29_A17 policies that address the use of Personal Data (PD) for internal research are developed and documented.
  18. PRI-29_A18 procedures that address the use of Personal Data (PD) for internal testing are developed and documented.
  19. PRI-29_A19 procedures that address the use of Personal Data (PD) for internal training are developed and documented.
  20. PRI-29_A20 procedures that address the use of Personal Data (PD) for internal research are developed and documented.
  21. PRI-29_A21 policies that address the use of Personal Data (PD) for internal testing are implemented.
  22. PRI-29_A22 policies that address the use of Personal Data (PD) for training are implemented.
  23. PRI-29_A23 policies that address the use of Personal Data (PD) for research are implemented.
  24. PRI-29_A24 procedures that address the use of Personal Data (PD) for internal testing are implemented.
  25. PRI-29_A25 procedures that address the use of Personal Data (PD) for training are implemented.
  26. PRI-29_A26 procedures that address the use of Personal Data (PD) for research are implemented.
  27. PRI-29_A27 the amount of Personal Data (PD) used for internal testing purposes is limited or minimized.
  28. PRI-29_A28 the amount of Personal Data (PD) used for internal training purposes is limited or minimized.
  29. PRI-29_A29 the amount of Personal Data (PD) used for internal research purposes is limited or minimized.
  30. PRI-29_A30 the required use of Personal Data (PD) for internal testing is authorized.
  31. PRI-29_A31 the required use of Personal Data (PD) for internal training is authorized.
  32. PRI-29_A32 the required use of Personal Data (PD) for internal research is authorized.
  33. PRI-29_A33 policies are reviewed frequently.
  34. PRI-29_A34 policies are updated frequently.
  35. PRI-29_A35 procedures are reviewed frequently.
  36. PRI-29_A36 procedures are updated frequently.

Evidence Requirements

E-PRI-02 Authorized Use

Documented evidence of authorized use definitions for privacy-related data operations.

Privacy

Technology Recommendations

Micro/Small

  • Data classification program
  • Data privacy program
  • Data Protection Impact Assessment (DPIA)
  • Product / project management

Small

  • Data classification program
  • Data privacy program
  • Data Protection Impact Assessment (DPIA)
  • Product / project management

Medium

  • Data classification program
  • Data privacy program
  • Data Protection Impact Assessment (DPIA)
  • Product / project management

Large

  • Data classification program
  • Data privacy program
  • Data Protection Impact Assessment (DPIA)
  • Product / project management

Enterprise

  • Data classification program
  • Data privacy program
  • Data Protection Impact Assessment (DPIA)
  • Product / project management

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Manage this control in SCF Connect

Track implementation status, collect evidence, and map controls to your compliance frameworks automatically.

Get Started Free