DAT-02 · Data and Privacy
Lawful, minimized processing
Personal data is processed on a stated basis, limited to what is needed and kept only as long as needed.
3frameworks fully address it
5partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2PartialP4.0 Only when privacy criteria are in scope.
- ISO 27001PartialA.5.34 Privacy of PII is required; lawful basis is not.
- NIST CSFPartialGV.OC-03 Through legal requirements.
- PCI DSSFull3.2.1
- HIPAAFull164.502(b)
- GDPRFullArt. 5, 6
- EU AI ActPartialArt. 10(5) Special category processing for bias detection.
- NIST AI RMFPartialMAP 4.1 Privacy risk mapping.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Processing records, retention schedule, deletion evidence.
?Why it exists
Minimization is the cheapest control there is.
For a smaller organizationA retention line per data type, applied on a calendar.