---

id: "PM-25" title: "Minimization of Personally Identifiable Information Used in Testing, Training, and Research" family: "PM" family_name: "Program Management" sort_id: "pm-25" priority: "P1" implementation_level: "organization"

---

Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;

Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;

Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and

Review and update policies and procedures {{ insert: param, pm-25_prm_1 }}.

Guidance

The use of personally identifiable information in testing, research, and training increases the risk of unauthorized disclosure or misuse of such information. Organizations consult with the senior agency official for privacy and/or legal counsel to ensure that the use of personally identifiable information in testing, training, and research is compatible with the original purpose for which it was collected. When possible, organizations use placeholder data to avoid exposure of personally identifiable information when conducting testing, training, and research.

Assessment Objective: policies that address the use of personally identifiable information for internal testing are developed and documented;

Assessment Objective: policies that address the use of personally identifiable information for internal training are developed and documented;

Assessment Objective: policies that address the use of personally identifiable information for internal research are developed and documented;

Assessment Objective: procedures that address the use of personally identifiable information for internal testing are developed and documented;

Assessment Objective: procedures that address the use of personally identifiable information for internal training are developed and documented;

Assessment Objective: procedures that address the use of personally identifiable information for internal research are developed and documented;

Assessment Objective: policies that address the use of personally identifiable information for internal testing, are implemented;

Assessment Objective: policies that address the use of personally identifiable information for training are implemented;

Assessment Objective: policies that address the use of personally identifiable information for research are implemented;

Assessment Objective: procedures that address the use of personally identifiable information for internal testing are implemented;

Assessment Objective: procedures that address the use of personally identifiable information for training are implemented;

Assessment Objective: procedures that address the use of personally identifiable information for research are implemented;

Assessment Objective: the amount of personally identifiable information used for internal testing purposes is limited or minimized;

Assessment Objective: the amount of personally identifiable information used for internal training purposes is limited or minimized;

Assessment Objective: the amount of personally identifiable information used for internal research purposes is limited or minimized;

Assessment Objective: the required use of personally identifiable information for internal testing is authorized;

Assessment Objective: the required use of personally identifiable information for internal training is authorized;

Assessment Objective: the required use of personally identifiable information for internal research is authorized;

Assessment Objective: policies are reviewed {{ insert: param, pm-25_odp.01 }};

Assessment Objective: policies are updated {{ insert: param, pm-25_odp.02 }};

Assessment Objective: procedures are reviewed {{ insert: param, pm-25_odp.03 }};

Assessment Objective: procedures are updated {{ insert: param, pm-25_odp.04 }}.

Privacy program plan

policies and procedures for the minimization of personally identifiable information used in testing, training, and research

documentation supporting policy implementation (e.g., templates for testing, training, and research

privacy threshold analysis

privacy risk assessment)

data sets used for testing, training, and research

Organizational personnel with privacy program responsibilities

organizational personnel with privacy responsibilities

system developers

personnel with IRB responsibilities

Organizational processes for data quality and personally identifiable information management

mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information