Before you collect or use personal data, you should be able to say what lets you do it. That is the idea behind PT-2 Authority to Process Personally Identifiable Information. NIST 800-53 binds US federal systems, and reaches others by contract. For private companies it is a reference, and it lines up with the legal basis questions customers and regulators ask.
What it means in practice
The statement has two parts. Determine and document the authority that permits the processing of PII, using the types of processing you define. And restrict processing to only what is authorized.
The guidance defines processing broadly. It covers creation, collection, use, storage, maintenance, dissemination, disclosure and disposal. It also covers logging, transformation and analysis such as data mining. So a log pipeline that captures email addresses counts.
In a federal setting the authority is a law or regulation. In a private company it is typically a contract, consent, a legal obligation or a legitimate interest, depending on the rules that apply to you. The record lists two enhancements: PT-2.1 Data Tagging and PT-2.2 Automation, which attach authority to data and enforce limits automatically.
Evidence to collect
- A register of PII processing activities, each with its authority.
- The mapping from data fields to the activity that justifies them.
- Reviews showing new processing was checked before launch.
- Technical controls that stop use outside the authorized scope, such as access rules.
Common gaps
- Data collected for support ends up in marketing analysis.
- No register exists, so the authority is unknown.
- Logs contain PII nobody listed.
How to implement it
Inventory what personal data you hold and why. Record the authority beside each entry. Add a launch checklist question: what personal data does this feature touch, and under what authority? Restrict access by role so use stays inside scope.
Quick check
Does a privacy policy page satisfy PT-2?
No. The page informs people. PT-2 needs your internal record of the authority for each type of processing, and controls that keep processing within it.
