PM-21, Accounting of Disclosures, asks you to keep an accurate record of disclosures of personally identifiable information (PII). Each entry has a date, the nature and purpose of the disclosure, and the name and contact details of whoever received it. You keep the record for as long as the PII is held or five years after the disclosure, whichever is longer. You also make it available to the person the PII concerns, on request.
What it means in practice
The Privacy Act requires this accounting of federal agencies, with statutory exceptions. The record advises agencies to consult their senior privacy official and legal counsel about those exceptions. 800-53 reaches others through contract, and the idea is a useful reference for any company that shares personal data with third parties.
NIST gives three purposes. People can learn who received their information. The organization has a basis for telling recipients about corrected or disputed data. And there is an audit trail for later review of compliance with disclosure conditions.
The hard part is not the log format. It is finding the disclosures. Data leaves through exports, support tickets, analytics tools and legal requests, and each path needs to write to the same record.
Evidence to collect
- The disclosure log with date, nature, purpose and recipient for each entry
- Retention rule showing the longer of data lifetime or five years
- The procedure for answering an individual request, with sample responses
- Records of notices sent to recipients after corrections
- Legal review of any exceptions you rely on
Common gaps
- Disclosures are logged in some systems but not in exports or support
- Log has no purpose field
- Records are deleted when the data is deleted, before the five years pass
- No process to give an individual their accounting
How to implement it
- Map every path by which PII leaves the company.
- Create one log schema and require each path to write to it.
- Set retention to match the statement.
- Write a short procedure for responding to requests and test it once.
Quick check
How long must the accounting be kept?
For the time the PII is maintained or five years after the disclosure, whichever is longer.
