PM-20, Dissemination of Privacy Program Information, asks for a central resource webpage on your principal public website. It should explain your privacy program, give the public a way to reach the privacy official, and publish privacy practices and reports. Federal agencies are bound to it, and customers often expect the same thing from vendors, so treat it as a reference.
What it means in practice
NIST describes the federal version as a page at the agency domain under the privacy path, holding public privacy impact assessments, notices, policies, instructions for access or amendment requests, and email addresses for questions or complaints. For a company, the same idea shrinks to a clear privacy page with your policy, your contact route and how to make a request.
The record lists one enhancement, PM-20.1 Privacy Policies on Websites, Applications, and Digital Services, which carries the idea to each site and app you run.
The contact route is the part people skip. The statement asks for publicly facing email addresses or phone lines so the public can send questions and feedback to the privacy office. A page with an address that bounces does not meet it.
Evidence to collect
- A live URL for the privacy page, linked from the site footer
- A monitored email address or form for privacy questions
- The current privacy policy with a visible last updated date
- A log of inquiries received and how they were answered
Common gaps
- The privacy page exists but the contact mailbox is unmonitored
- The policy on the app differs from the policy on the website
- No instructions for how an individual can request access or correction
How to implement it
- Create one canonical privacy page and link every product and app to it.
- Route the contact address to a shared inbox with a named owner.
- Add a step in your release checklist to update the page when data practices change.
Quick check
What is the minimum public contact the control expects?
The statement calls for publicly facing email addresses and or phone lines so people can send feedback and questions to the privacy office.
