Privacy & Regulatory Frameworks

Why this topic matters

Privacy is about how personal information is collected, used, shared, retained, and disposed of — in line with commitments to individuals and with the law. Information Systems and Controls (ISC) Area II tests privacy principles, the major US and international regulations, and techniques that reduce privacy risk. Confidentiality protects any sensitive information; privacy is specific to personal information.

Key terms

• Personally identifiable information (PII): information that identifies, or can be linked to, an individual — name, Social Security number, account numbers, biometrics, location data, online identifiers.
• Sensitive personal information: health, financial, biometric, children's data, precise location, and similar categories requiring extra protection.
• Data controller (decides why and how personal data is processed) versus data processor (processes it on the controller's behalf, such as a payroll provider).
• Privacy by design: building privacy into systems from the start, with privacy-protective defaults.

Privacy principles

The American Institute of Certified Public Accountants (AICPA) and Chartered Institute of Management Accountants (CIMA) Privacy Management Framework organizes privacy into nine components:

1. Management — policies, roles, and accountability.
2. Agreement, notice, and communication — tell individuals what is collected and why; obtain agreement.
3. Collection and creation — collect only for identified purposes.
4. Use, retention, and disposal — use only as notified; retain no longer than needed; dispose securely.
5. Access — individuals can review and correct their information.
6. Disclosure to third parties — only as notified, with appropriate protection.
7. Security for privacy — protect personal information against unauthorized access.
8. Data integrity and quality — accurate, complete, relevant.
9. Monitoring and enforcement — monitor compliance and handle complaints.

The privacy category of the Trust Services Criteria (used in System and Organization Controls (SOC) 2 reports) follows similar principles. The Fair Information Practice Principles (notice, choice, access, security, enforcement) underlie most privacy laws.

Major regulations

Law or standard	Scope	Key requirements
General Data Protection Regulation (GDPR) — European Union (EU)	Personal data of people in the EU, including by organizations outside it that offer them goods or services or monitor them	A lawful basis for processing (consent, contract, legal obligation, legitimate interests, and others); data minimization and purpose limitation; individual rights (access, rectification, erasure, portability, objection); data protection impact assessments for high-risk processing; breach notification to regulators within 72 hours; fines up to 4% of worldwide annual turnover or €20 million
California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA)	For-profit businesses meeting size or data thresholds that handle California residents' data	Rights to know, delete, correct, and opt out of the sale or sharing of personal information; limits on sensitive data use; enforced by the California Privacy Protection Agency. Many other states have similar comprehensive laws.
Health Insurance Portability and Accountability Act (HIPAA)	Covered entities (health plans, providers, clearinghouses) and their business associates	Privacy Rule for protected health information; Security Rule (administrative, physical, and technical safeguards for electronic health information); Breach Notification Rule; business associate agreements
Gramm-Leach-Bliley Act (GLBA)	Financial institutions (including tax preparers and many accounting firms)	Privacy notices and opt-out rights; the Safeguards Rule requires a written information security program, a qualified individual to oversee it, risk assessments, encryption, multi-factor authentication, and notice to the Federal Trade Commission of breaches affecting 500 or more customers
Payment Card Industry Data Security Standard (PCI DSS), version 4.0	Any organization that stores, processes, or transmits cardholder data (an industry standard, enforced by contract)	12 requirements — network security, protecting stored data, encryption in transit, vulnerability management, strong access control, monitoring and testing, security policy
Children's Online Privacy Protection Act	Online services directed to children under 13	Verifiable parental consent
State data breach notification laws	All 50 states	Notify affected residents (and sometimes regulators) of breaches of personal information

For tax practitioners, Internal Revenue Code Section 7216 restricts use and disclosure of tax return information, and the Internal Revenue Service expects a written information security plan.

Privacy-enhancing techniques

Technique	Description
Data minimization	Collect and keep only what's needed
Anonymization	Irreversibly removes identifiers so individuals can't be re-identified — anonymized data generally falls outside privacy laws
Pseudonymization	Replaces identifiers with tokens or codes; re-identification is possible with separately held information — still personal data
Tokenization	Replaces sensitive values (card numbers) with non-sensitive tokens; the mapping is held in a secure vault
Data masking	Hides parts of data (showing only the last four digits), often in test environments
Encryption	Protects data but is reversible with the key

A privacy program

• Inventory and map personal data (what, where, why, who has access, how long).
• Publish clear privacy notices and manage consent and preferences.
• Conduct privacy impact assessments for new systems and vendors.
• Handle individual rights requests within legal deadlines.
• Contract with vendors for data protection; monitor them.
• Train staff; prepare for breach response and notification.

How it is tested

• Distinguish privacy from confidentiality and security.
• Match a scenario to the applicable law (GDPR, HIPAA, GLBA, PCI DSS, CCPA).
• Identify privacy principles and individual rights.
• Distinguish anonymization, pseudonymization, tokenization, and masking.