ISC, Information Systems and Controls
Sources for Confidentiality and Privacy: Regulations, Classification, and Safeguards
Last reviewed
The standards and authorities behind PocketCPA's ISC lessons on Confidentiality and Privacy: Regulations, Classification, and Safeguards. The topic rests on AICPA Trust Services Criteria (security common criteria, confidentiality, privacy); GLBA Safeguards Rule 16 CFR 314.3 and 314.4; GLBA Financial Privacy Rule 12 CFR 1016.4, 1016.7 and 1016.10; HIPAA Security Rule 45 CFR 164.306, 164.308, 164.310, 164.312 and 164.316; HIPAA Privacy Rule 45 CFR part 164 subpart E; GDPR Articles 3, 4, 5, 6, 17, 32, 33 and 34 and Recital 26; CCPA and CPRA at Cal. Civ. Code 1798.105, 1798.106, 1798.110, 1798.120 and 1798.121; NIST SP 800-53 Rev. 5 RA-2, AC-4, SC-7(10), SC-8, SC-28, MP-6, SI-12, SI-19, PT-3, PT-4 and PT-5; NIST SP 800-88 Rev. 2.
About this topic
A negotiated rate card and a list of employees' home addresses can sit in the same folder, on the same server, behind the same encryption. They are not governed by the same rules. One is protected because the entity said so, and the other because of whose it is.
The question this group answers. Which rules reach a given piece of information, how much protection its sensitivity earns, and what the entity owes when that information escapes or when the purpose it was collected for runs out.
Key points
- GDPR requires a lawful basis for processing, grants rights of access and erasure, and applies extraterritorially.
- Data classification (public, internal, confidential, restricted) drives the controls applied to each category.
- Privacy by design builds data protection into systems from the start rather than adding it later.
- Data minimization limits collection to what is necessary for the stated purpose.
What the lessons cover
- Confidentiality versus privacy
- Core privacy regulations
- PII and data classification
- Encryption and data-loss prevention
- Notice, choice, consent, and purpose limitation
- Routing a fact pattern to the right regime
- The GDPR breach-notification clock
- Retention, secure disposal, and media sanitization
Authoritative references
Regulations:
- GLBA Safeguards Rule, 16 CFR 314.3 and 314.4, the objectives and the required elements of the information security program.
- GLBA Financial Privacy Rule, 12 CFR 1016.4, 1016.7 and 1016.10, the initial privacy notice, the opt-out notice, and the limits on disclosure of nonpublic personal information to nonaffiliated third parties.
- HIPAA Security Rule, 45 CFR 164.306, 164.308, 164.310, 164.312 and 164.316, the general rules and the administrative, physical, and technical safeguards, with the policies and documentation requirements.
- HIPAA Privacy Rule, 45 CFR part 164, subpart E, the uses and disclosures of protected health information.
- GDPR Articles 3, 4, 5, 6, 17, 32, 33 and 34, and Recital 26, the territorial scope, definitions, principles, lawful bases, the right to erasure, security of processing, and notification of a breach to the supervisory authority and to data subjects; Recital 26 addresses anonymous information.
- CCPA and CPRA, Cal. Civ. Code 1798.105, 1798.106, 1798.110, 1798.120 and 1798.121, the rights to delete, to correct, to know, to opt out of sale or sharing, and to limit the use of sensitive personal information.
Frameworks and standards:
- AICPA Trust Services Criteria, the security common criteria, confidentiality, and privacy.
- NIST SP 800-53 Rev. 5, the controls cited: RA-2 security categorization, AC-4 information flow enforcement, SC-7(10) preventing exfiltration, SC-8 and SC-8(1) transmission confidentiality and integrity, SC-28 protection of information at rest, MP-6 and MP-6(1) media sanitization, SI-12 information management and retention, SI-19 and SI-19(1) de-identification, and PT-3, PT-4 and PT-5 processing purposes, consent, and privacy notice.
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.