A privacy notice is the part of your privacy program the public can read, so it is the part reviewers read first. PT-5 Privacy Notice sets what it should do. NIST 800-53 binds US federal systems, and others through contracts. For everyone else it is a reference, and a good checklist for your own notice.
What it means in practice
The statement requires a notice to individuals about PII processing that meets several conditions. It is available when people first interact with you, and again at a frequency you define. It is clear and easy to understand, in plain language. It identifies the authority for processing and the purposes. A final element lets you add content you define, such as who data is shared with and what choices people have.
The guidance adds that laws and policies may require specific elements or formats. A notice that satisfies a legal rule can still fail PT-5 if people cannot understand it.
The record lists two enhancements. PT-5.1 Just in time Notice gives a notice at the moment of collection. PT-5.2 Privacy Act Statements applies to federal collections under the Privacy Act and is rarely relevant to a private company.
Evidence to collect
- The current notice, with version history and publication dates.
- Screenshots of where it appears: signup, forms, mobile apps, support channels.
- A mapping from each statement to the processing register behind it.
- Plain language review results, such as a readability check or user test.
- Records of when the notice was last re shown to existing users.
Common gaps
- The notice describes data flows that changed a year ago.
- It is written for lawyers and runs thousands of words.
- It appears on the website but not in the mobile app or the API signup.
- Nobody owns the process of updating it after product changes.
How to implement it
Treat the notice as a document with an owner and a release process. Tie it to the data inventory so a change in one prompts a review of the other. Write for a reader with no legal training, and test it on someone outside the team.
Add layers. A short summary at the point of collection links to the full text. That covers the just in time idea without burying people.
Keep the version history public. It shows an auditor that you review the notice and shows customers when something changed.
Quick check
Is a link in the website footer enough?
Only if people first meet you on the website. The control says the notice should be available upon first interaction. If signup happens in an app, the notice has to be there.
Does PT-5.2 apply to a commercial SaaS?
Usually not. It covers Privacy Act statements, which are tied to federal collection.
