DAT-03 · Data and Privacy
Deliberate data sharing
Data leaves the organization only through a decided channel, with a defined end and a record of what was shared.
6frameworks fully address it
1partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC6.7
- ISO 27001FullA.5.14
- NIST CSFFullPR.DS-02
- PCI DSSFull4.2.1
- HIPAAFull164.308(b)
- GDPRFullArt. 28, 44
- EU AI ActAbsent No general data sharing duty; obligations attach to the AI system and its documentation.
- NIST AI RMFPartialMAP 4.1 Third-party data flows are mapped.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Sharing decision records, data room logs, revocation evidence.
?Why it exists
Most exposure is not a breach; it is sharing nobody ended.
For a smaller organizationA record per share, and a close-out when it ends.