---
tags:
  - Rev5
  - Controls
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Personally Identifiable Information Processing and Transparency (PT)

This page contains all **21** controls and control enhancements in the Personally Identifiable Information Processing and Transparency (PT) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.

!!! info "Official NIST OSCAL source"
    - **Catalog version:** 5.2.0
    - **OSCAL version:** 1.2.2
    - **Catalog last modified:** May 11, 2026

## PT-01 (Policy and Procedures) { #pt-01 }

!!! quote ""
    - **a.** Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
        - **1.** [Selection: one or more of: organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy that:
            - **(a)** Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            - **(b)** Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        - **2.** Procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and the associated personally identifiable information processing and transparency controls;
    - **b.** Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures; and
    - **c.** Review and update the current personally identifiable information processing and transparency:
        - **1.** Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
        - **2.** Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-1)

---

## PT-02 (Authority to Process Personally Identifiable Information) { #pt-02 }

!!! quote ""
    - **a.** Determine and document the [Assignment: organization-defined authority] that permits the [Assignment: organization-defined processing] of personally identifiable information; and
    - **b.** Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is authorized.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-2)

---

## PT-02 (01) (Data Tagging) { #pt-02-01 }

!!! quote ""
    Attach data tags containing [Assignment: organization-defined authorized processing] to [Assignment: organization-defined elements of personally identifiable information].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-2-1)

---

## PT-02 (02) (Automation) { #pt-02-02 }

!!! quote ""
    Manage enforcement of the authorized processing of personally identifiable information using [Assignment: organization-defined automated mechanisms].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-2-2)

---

## PT-03 (Personally Identifiable Information Processing Purposes) { #pt-03 }

!!! quote ""
    - **a.** Identify and document the [Assignment: organization-defined purpose(s)] for processing personally identifiable information;
    - **b.** Describe the purpose(s) in the public privacy notices and policies of the organization;
    - **c.** Restrict the [Assignment: organization-defined processing] of personally identifiable information to only that which is compatible with the identified purpose(s); and
    - **d.** Monitor changes in processing personally identifiable information and implement [Assignment: organization-defined mechanisms] to ensure that any changes are made in accordance with [Assignment: organization-defined requirements].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-3)

---

## PT-03 (01) (Data Tagging) { #pt-03-01 }

!!! quote ""
    Attach data tags containing the following purposes to [Assignment: organization-defined elements of personally identifiable information]: [Assignment: organization-defined processing purposes].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-3-1)

---

## PT-03 (02) (Automation) { #pt-03-02 }

!!! quote ""
    Track processing purposes of personally identifiable information using [Assignment: organization-defined automated mechanisms].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-3-2)

---

## PT-04 (Consent) { #pt-04 }

!!! quote ""
    Implement [Assignment: organization-defined tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-4)

---

## PT-04 (01) (Tailored Consent) { #pt-04-01 }

!!! quote ""
    Provide [Assignment: organization-defined mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-4-1)

---

## PT-04 (02) (Just-in-time Consent) { #pt-04-02 }

!!! quote ""
    Present [Assignment: organization-defined consent mechanisms] to individuals at [Assignment: organization-defined frequency] and in conjunction with [Assignment: organization-defined personally identifiable information processing].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-4-2)

---

## PT-04 (03) (Revocation) { #pt-04-03 }

!!! quote ""
    Implement [Assignment: organization-defined tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-4-3)

---

## PT-05 (Privacy Notice) { #pt-05 }

!!! quote ""
    Provide notice to individuals about the processing of personally identifiable information that:
    
    - **a.** Is available to individuals upon first interacting with an organization, and subsequently at [Assignment: organization-defined frequency];
    - **b.** Is clear and easy-to-understand, expressing information about personally identifiable information processing in plain language;
    - **c.** Identifies the authority that authorizes the processing of personally identifiable information;
    - **d.** Identifies the purposes for which personally identifiable information is to be processed; and
    - **e.** Includes [Assignment: organization-defined information].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-5)

---

## PT-05 (01) (Just-in-time Notice) { #pt-05-01 }

!!! quote ""
    Present notice of personally identifiable information processing to individuals at a time and location where the individual provides personally identifiable information or in conjunction with a data action, or [Assignment: organization-defined frequency].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-5-1)

---

## PT-05 (02) (Privacy Act Statements) { #pt-05-02 }

!!! quote ""
    Include Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provide Privacy Act statements on separate forms that can be retained by individuals.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-5-2)

---

## PT-06 (System of Records Notice) { #pt-06 }

!!! quote ""
    For systems that process information that will be maintained in a Privacy Act system of records:
    
    - **a.** Draft system of records notices in accordance with OMB guidance and submit new and significantly modified system of records notices to the OMB and appropriate congressional committees for advance review;
    - **b.** Publish system of records notices in the Federal Register; and
    - **c.** Keep system of records notices accurate, up-to-date, and scoped in accordance with policy.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-6)

---

## PT-06 (01) (Routine Uses) { #pt-06-01 }

!!! quote ""
    Review all routine uses published in the system of records notice at [Assignment: organization-defined frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-6-1)

---

## PT-06 (02) (Exemption Rules) { #pt-06-02 }

!!! quote ""
    Review all Privacy Act exemptions claimed for the system of records at [Assignment: organization-defined frequency] to ensure they remain appropriate and necessary in accordance with law, that they have been promulgated as regulations, and that they are accurately described in the system of records notice.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-6-2)

---

## PT-07 (Specific Categories of Personally Identifiable Information) { #pt-07 }

!!! quote ""
    Apply [Assignment: organization-defined processing conditions] for specific categories of personally identifiable information.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-7)

---

## PT-07 (01) (Social Security Numbers) { #pt-07-01 }

!!! quote ""
    When a system processes Social Security numbers:
    
    - **(a)** Eliminate unnecessary collection, maintenance, and use of Social Security numbers, and explore alternatives to their use as a personal identifier;
    - **(b)** Do not deny any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his or her Social Security number; and
    - **(c)** Inform any individual who is asked to disclose his or her Social Security number whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-7-1)

---

## PT-07 (02) (First Amendment Information) { #pt-07-02 }

!!! quote ""
    Prohibit the processing of information describing how any individual exercises rights guaranteed by the First Amendment unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-7-2)

---

## PT-08 (Computer Matching Requirements) { #pt-08 }

!!! quote ""
    When a system or organization processes information for the purpose of conducting a matching program:
    
    - **a.** Obtain approval from the Data Integrity Board to conduct the matching program;
    - **b.** Develop and enter into a computer matching agreement;
    - **c.** Publish a matching notice in the Federal Register;
    - **d.** Independently verify the information produced by the matching program before taking adverse action against an individual, if required; and
    - **e.** Provide individuals with notice and an opportunity to contest the findings before taking adverse action against an individual.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/pt-8)

---
