For systems that process personally identifiable information: Apply the following processing rules to data elements of personally identifiable information: processing rules; Monitor for permitted processing at the external interfaces to the system and at key internal boundaries within the system; Document each processing exception; and Review and remove exceptions that are no longer supported.
Managing the processing of personally identifiable information is an important aspect of protecting an individual’s privacy. Applying, monitoring for, and documenting exceptions to processing rules ensure that personally identifiable information is processed only in accordance with established privacy requirements.
processing rules are applied to data elements of personally identifiable information on systems that process personally identifiable information; permitted processing is monitored at the external interfaces to the systems that process personally identifiable information; permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information; each processing exception is documented for systems that process personally identifiable information; exceptions for systems that process personally identifiable information are reviewed; exceptions for systems that process personally identifiable information that are no longer supported are removed.
No cross-framework mappings available