P1.1 Privacy notice
Giving data subjects notice of privacy practices and updating it promptly when practices change, including changes in how personal information is used. The single criterion in the P1 notice group.
P1 to P8 Privacy
Additional criteria for the privacy category: notice, choice and consent, collection, use, retention and disposal, access, disclosure and notification, quality, and monitoring and enforcement.
P2.1 Choice and consent
Communicating the choices data subjects have over collection, use, retention, disclosure and disposal of personal information, obtaining explicit consent where required, and documenting the basis for implicit consent.
P3.1 Collection of personal information
Collecting personal information only in line with the organization's privacy objectives: limiting collection, using fair and lawful means and reliable sources, and telling data subjects when more information is acquired.
P3.2 Explicit consent for collection
For information that requires explicit consent, telling data subjects why consent is needed and what happens if they refuse, and obtaining consent before collection.
P4.1 Use limitation
Limiting use of personal information to the purposes identified in the organization's privacy objectives. The first of three P4 criteria on use, retention and disposal.
P4.2 Retention of personal information
Retaining personal information only as long as the organization's privacy objectives allow, and protecting it while it is retained.
P4.3 Disposal of personal information
Securely disposing of personal information: capturing and flagging deletion requests, and disposing of, destroying or redacting personal information.
P5.1 Data subject access
Letting identified and authenticated data subjects review and obtain copies of their stored personal information, and explaining any denial.
P5.2 Correction of personal information
Correcting, amending or appending personal information based on what data subjects provide, passing corrections to third parties as committed or required, and explaining any denial.
P6.1 Disclosure to third parties
Disclosing personal information to third parties only with the data subject's explicit consent obtained beforehand. The first of seven P6 criteria on disclosure and notification.
P6.2 Record of authorized disclosures
Creating and keeping a complete, accurate and timely record of authorized disclosures of personal information.
P6.3 Record of unauthorized disclosures
Creating and keeping a complete, accurate and timely record of detected or reported unauthorized disclosures of personal information, including breaches.
P6.4 Third-party privacy commitments
Obtaining privacy commitments from vendors and other third parties with access to personal information, assessing their compliance periodically and as needed, and taking corrective action.
P6.5 Third-party notification commitments
Obtaining commitments from vendors and third parties to notify the organization of actual or suspected unauthorized disclosures, and routing those notices into incident response.
P6.6 Breach and incident notification
Notifying affected data subjects, regulators and others of breaches and incidents, based on identified reporting requirements.
P6.7 Accounting of personal information and disclosures
Giving data subjects, on request, an accounting of the personal information held about them and of disclosures of it.
P7.1 Quality of personal information
Collecting and maintaining personal information that is accurate, up to date, complete and relevant. The single criterion in the P7 quality group.
P8.1 Inquiries, complaints and disputes
A process to receive, address, resolve and report back on privacy inquiries, complaints and disputes, with periodic compliance monitoring and timely correction of deficiencies.
