id: "PM-20(01)" title: "Privacy Policies on Websites, Applications, and Digital Services" family: "PM" family_name: "Program Management" sort_id: "pm-20.01" priority: "P1" implementation_level: "organization" parent: "PM-20" enhancement: True
Statement
Develop and post privacy policies on all external-facing websites, mobile applications, and other digital services, that:
Are written in plain language and organized in a way that is easy to understand and navigate;
Provide information needed by the public to make an informed decision about whether and how to interact with the organization; and
Are updated whenever the organization makes a substantive change to the practices it describes and includes a time/date stamp to inform the public of the date of the most recent changes.
Guidance
Organizations post privacy policies on all external-facing websites, mobile applications, and other digital services. Organizations post a link to the relevant privacy policy on any known, major entry points to the website, application, or digital service. In addition, organizations provide a link to the privacy policy on any webpage that collects personally identifiable information. Organizations may be subject to applicable laws, executive orders, directives, regulations, or policies that require the provision of specific information to the public. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.
Assessment Objective: privacy policies are developed and posted on all external-facing websites;
Assessment Objective: privacy policies are developed and posted on all mobile applications;
Assessment Objective: privacy policies are developed and posted on all other digital services;
Assessment Objective: the privacy policies are written in plain language;
Assessment Objective: the privacy policies are organized in a way that is easy to understand and navigate;
Assessment Objective: the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;
Assessment Objective: the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;
Assessment Objective: the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;
Assessment Objective: the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.
Privacy program plan
privacy policies on the agency website, mobile applications, and/or other digital services
Organizational personnel with privacy program information dissemination responsibilities
organizational personnel with privacy responsibilities
Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing
organizational procedures and practices for disseminating privacy program information
mechanisms supporting the dissemination of privacy program information