PT-3 Personally Identifiable Information Processing Purposes is about stating why you hold personal data and sticking to it. NIST 800-53 binds US federal systems, and other organizations through contracts. For everyone else it is a reference that matches the purpose limitation ideas found in many privacy laws.
What it means in practice
The statement has four parts. Identify and document the purposes for processing PII. Describe those purposes in your public privacy notices and policies. Restrict processing to what is compatible with the identified purposes. And monitor changes in processing, with defined mechanisms to make sure changes follow your rules.
The guidance calls documenting purpose a prerequisite. People whose data you hold, and your own operators, cannot understand how the data will be handled unless the purposes are written down. The record lists PT-3.1 Data Tagging and PT-3.2 Automation as enhancements.
Evidence to collect
- A purposes register tied to data categories and systems.
- The sections of your public notice that state purposes, with a matching version history.
- Change records for new uses, with the compatibility review.
- Any tagging or access rule that enforces purpose.
Common gaps
- The notice describes purposes the product no longer has, or omits new ones.
- A new analytics feature reuses old data with no review.
- Purposes are written in general terms like "to improve our services".
How to implement it
Pair the purposes register with your data inventory. Review each product change that touches personal data against it, and update the notice in the same release. Keep the review as a short ticket field.
Quick check
What counts as a compatible purpose?
The control leaves the test to you. Write the criteria down, such as closeness to the original purpose and what people would reasonably expect, and apply it the same way each time.
