The NIST Privacy Framework is a voluntary tool from the US National Institute of Standards and Technology for identifying and managing privacy risk: the chance that the way an organization collects, uses, shares or stores personal data causes problems for the people the data is about. Like the NIST Cybersecurity Framework (NIST CSF), it describes outcomes rather than prescribing specific controls or products, and it is meant to work across sectors, sizes and legal regimes. This entry is general information, not legal advice; privacy obligations depend on jurisdiction, sector and the data involved.
At a glance
- It is voluntary guidance with no certification, published by NIST in January 2020 as version 1.0.
- Version 1.0 organizes privacy outcomes into five functions: Identify-P, Govern-P, Control-P, Communicate-P and Protect-P.
- It uses profiles and implementation tiers, the same building blocks as the Cybersecurity Framework.
- It is law-neutral: it helps structure a program that can support GDPR, US state laws and others, without replacing them.
- NIST has released a draft update aligned with CSF 2.0; check which version your advisors and tools use.
What problem it solves
Privacy obligations come from many directions: the GDPR, US state laws such as the CCPA, sector rules, contracts and customer expectations. Organizations that treat each one as a separate project end up with duplicated work and gaps, and they often leave privacy to legal while security sits with IT.
Privacy problems are also not only security problems. An organization can keep personal data perfectly secure and still cause harm by collecting more than it needs, using it in unexpected ways or keeping it too long. The Privacy Framework gives legal, security, IT and business teams one structure for understanding what data the organization processes, what could go wrong for individuals and what to do about it, so a single program can support many obligations.
How it works
Core. The Core is a set of privacy outcomes organized into functions, categories and subcategories. In version 1.0, Identify-P covers understanding data processing and the privacy risks it creates; Govern-P covers policies, roles, legal requirements and risk tolerance; Control-P covers managing data with enough precision to act on privacy decisions, such as minimizing it; Communicate-P covers transparency with individuals and others; and Protect-P covers data safeguards against security-related privacy events.
Profiles. A current profile records which outcomes the organization achieves today; a target profile records which ones it is aiming for. The gap becomes a prioritized plan.
Tiers. Implementation tiers describe how mature and integrated privacy risk management is across the organization (see below).
Using it with the CSF. The Privacy Framework and the Cybersecurity Framework were built to be used side by side. Protect-P overlaps with security, and NIST points organizations to the CSF for detecting, responding to and recovering from security incidents. Many organizations run both in one governance, risk and compliance (GRC) program, alongside their data governance work.
Tiers and profiles
The Privacy Framework has no compliance levels and nothing to pass. Its implementation tiers describe how an organization manages privacy risk, and organizations choose a target tier based on their risk, obligations and resources. The table reflects version 1.0.
| Tier | What it looks like in practice | How it is set | Typical evidence |
|---|---|---|---|
| Tier 1: Partial | Privacy risk handled case by case; limited awareness across the organization | Self-assessed, or with an advisor | Internal or advisor assessment |
| Tier 2: Risk Informed | Management approves privacy risk practices, but they are not organization-wide policy | Self-assessed, or with an advisor | Internal or advisor assessment |
| Tier 3: Repeatable | Privacy practices are formal policy, applied consistently and updated as processing and laws change | Self-assessed, or with an advisor | Approved policies, data inventories, regular reporting |
| Tier 4: Adaptive | Practices adapt from lessons learned and changing conditions; privacy risk is part of organizational culture | Self-assessed, or with an advisor | Ongoing metrics and executive reporting |
A vendor claiming alignment with the Privacy Framework is describing its own or an advisor’s assessment; ask to see the scope and the profile behind it.
When it matters for buyers
- When building a privacy program for several laws at once. The framework gives one structure that legal and IT can share.
- When choosing a privacy or GRC platform. Check whether it maps controls to the Privacy Framework as well as to specific laws.
- When hiring a privacy advisor or virtual DPO service. Ask whether they assess against the framework and what you receive.
- When outsourcing processing of personal data. Use the functions to structure questions about how a provider inventories, limits and protects your data.
- When the board asks about privacy risk. Profiles and tiers give a consistent way to report progress.
Our governance, risk and compliance overview covers advisors and platforms that run privacy assessments and track remediation.
Questions to ask vendors
- Which Privacy Framework functions and categories does your product or service support, and which does it leave to us?
- Can you map your privacy controls to the framework and to the specific laws we must meet?
- How do you inventory and limit the personal data you process on our behalf?
- How do you support individuals’ requests, such as access or deletion, for data you hold for us?
- Which version of the Privacy Framework do your mappings use, and how will you handle the update?
- What evidence can you share, and was any assessment performed independently?
How it differs from the NIST Cybersecurity Framework
The NIST Cybersecurity Framework focuses on cybersecurity risk: protecting systems and data from unauthorized access, disruption and loss. The Privacy Framework focuses on privacy risk to individuals from data processing, including risks that arise when systems are working as intended, such as over-collection or unexpected use. They share a similar structure of functions, profiles and tiers and overlap where security protects personal data, so many organizations use them together. For the wider family of NIST guidance, see the NIST SP 800 series.
Problems this helps with
- Privacy laws keep multiplying and we need one program that covers them
- Security and privacy teams work separately and duplicate effort
- No clear picture of what personal data we process and why
- Customers and regulators ask how we manage privacy risk
