id: "PT-07" title: "Specific Categories of Personally Identifiable Information" family: "PT" family_name: "PII Processing and Transparency" sort_id: "pt-07" priority: "P2" implementation_level: "organization" enhancements: - pt-7.1 - pt-7.2
Statement
Apply {{ insert: param, pt-07_odp }} for specific categories of personally identifiable information.
Guidance
Organizations apply any conditions or protections that may be necessary for specific categories of personally identifiable information. These conditions may be required by laws, executive orders, directives, regulations, policies, standards, or guidelines. The requirements may also come from the results of privacy risk assessments that factor in contextual changes that may result in an organizational determination that a particular category of personally identifiable information is particularly sensitive or raises particular privacy risks. Organizations consult with the senior agency official for privacy and legal counsel regarding any protections that may be necessary.
Assessment Objective
{{ insert: param, pt-07_odp }} are applied for specific categories of personally identifiable information.
Personally identifiable information processing and transparency policy and procedures
privacy notice
Privacy Act system of records
computer matching agreements and notices
contracts
privacy information sharing agreements
memoranda of understanding
governing requirements
privacy plan
other relevant documents or records
Organizational personnel with personally identifiable information processing and transparency responsibilities
organizational personnel with information security and privacy responsibilities
Organizational processes for supporting and/or implementing personally identifiable information processing