---

id: "SI-19(03)" title: "Release" family: "SI" family_name: "System and Information Integrity" sort_id: "si-19.03" priority: "P1" implementation_level: "system" parent: "SI-19" enhancement: True

---

Statement

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Guidance

Prior to releasing a dataset, a data custodian considers the intended uses of the dataset and determines if it is necessary to release personally identifiable information. If the personally identifiable information is not necessary, the information can be removed using de-identification techniques.

Assessment Objective

personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

System and information integrity policy

system and information integrity procedures

personally identifiable information processing policy

de-identification procedures

procedures for minimizing the release of personally identifiable information

system configuration

data release mechanisms

system security plan

privacy plan

privacy impact assessment

privacy risk assessment documentation

other relevant documents or records

Organizational personnel responsible for de-identifying the dataset

organizational personnel with information security and privacy responsibilities

Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset