SCF Data Privacy Management Principles
In support of the Cybersecurity & Data Privacy by Design (C|P) initiative, a volunteer effort created the SCF Data Privacy Management Principles (DPMP). When you tie the broader C|P in with these privacy management principles, you have an excellent foundation for building and maintaining secure systems, applications and services that address cybersecurity and privacy considerations by default and by design.
We saw a need and we took action, since many cybersecurity and even privacy professionals have a hard time identifying "what right looks like" when picking a set of privacy principles for an organization to align to. What we did was select over a dozen of the most common privacy frameworks and create a "best in class" approach to managing privacy expectations. The best part is these are all mapped to the SCF, so you can leverage the SCF for both your cybersecurity and privacy needs!
The end result is the SCF's Data Privacy Management Principles:
- AICPA’s Trust Services Criteria (TSC) SOC 2 (2017)
- Asia-Pacific Economic Cooperation (APEC)
- California Privacy Rights Act (CPRA)
- European Union General Data Protection Regulation (EU GDPR)
- Fair Information Practice Principles (FIPPs) - Department of Homeland Security (DHS)
- Fair Information Practice Principles (FIPPs) - Office of Management and Budget (OMB)
- Generally Accepted Privacy Principles (GAPP)
- HIPAA Privacy Rule
- ISO 27701
- ISO 29100
- Nevada SB820
- NIST SP 800-53 R4
- NIST SP 800-53 R5
- NIST Privacy Framework v1.0
- Organization for Economic Co-operation and Development (OECD)
- Office of Management and Budget (OMB) - Circular A-130
- Personal Information Protection and Electronic Documents Act (PIPEDA)
We took these frameworks and looked for similarities and also for gaps. If you download the SCF Data Privacy Management Principles, you will see the direct mapping to these leading privacy frameworks so you know the origin of the principle we include in our document. This will be a great tool for organizations that may have to address multiple requirements, since it brings a common language to simply things.
The eighty-six (86) principles of the SCF Data Privacy Management Principles are organized into eleven (11) domains:
- Privacy by Design
- Data Subject Participation
- Limited Collection & Use
- Transparency
- Data Lifecycle Management
- Data Subject Rights
- Security by Design
- Incident Response
- Risk Management
- Third-Party Management
- Business Environment