ID-P: Identify-P
Description
Develop the organizational understanding to manage privacy risk for individuals arising from data processing.
The activities in the Identify-P Function are foundational for effective use of the Privacy Framework. Inventorying the circumstances under which data are processed, understanding the privacy interests of individuals directly or indirectly served or affected by an organization, and conducting risk assessments enable an organization to understand the business environment in which it is operating and identify and prioritize privacy risks.
Framework Categories
ID.IM-P: Inventory And Mapping
Data processing by systems, products, or services is understood and informs the management of privacy risk.
ID.BE-P: Business Environment
The organization’s mission, objectives, stakeholders, and activities are understood and prioritized; this information is used to inform privacy roles, responsibilities, and risk management decisions.
ID.RA-P: Risk Assessment
The organization understands the privacy risks to individuals and how such privacy risks may create follow-on impacts on organizational operations, including mission, functions, other risk management priorities (e.g., compliance, financial), reputation, workforce, and culture.
ID.DE-P: Data Processing Ecosystem Risk Management
The organization’s priorities, constraints, risk tolerance, and assumptions are established and used to support risk decisions associated with managing privacy risk and third parties within the data processing ecosystem. The organization has established and implemented the processes to identify, assess, and manage privacy risks within the data processing ecosystem.