---

id: "SI-18(02)" title: "Data Tags" family: "SI" family_name: "System and Information Integrity" sort_id: "si-18.02" priority: "P1" implementation_level: "system" parent: "SI-18" enhancement: True

---

Statement

Employ data tags to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

Guidance

Data tagging personally identifiable information includes tags that note processing permissions, authority to process, de-identification, impact level, information life cycle stage, and retention or last updated dates. Employing data tags for personally identifiable information can support the use of automation tools to correct or delete relevant personally identifiable information.

Assessment Objective

data tags are employed to automate the correction or deletion of personally identifiable information across the information life cycle within organizational systems.

System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

procedures addressing data tagging

personally identifiable information inventory

system audit records

audit findings

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Organizational personnel responsible for tagging data

organizational personnel with information security and privacy responsibilities

Data tagging mechanisms

automated mechanisms supporting and/or implementing data tagging