Law / Frameworks / NIST Privacy Framework / Identify-P
NIST Privacy Framework, Identify-PID.DE-P5
Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.NIST Privacy Framework, version 1.0, January 2020, ID.DE-P5
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 7
- laws
- 7
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- NIST CSF 2.0GV.SC-07 The risks posed by a supplier, their products and services, and other third..., 3 laws
- NIST CSF 2.0GV.SC-06 Planning and due diligence are performed to reduce risks before entering..., 2 laws
Comprehensive regime
4 laws, 4 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 China |
Personal Information Protection Law of the PRC, General Processing Rules and Lawful Bases |
Where personal information is entrusted to a third party processor, execute a written entrustment agreement and supervise that processor's handling; the processor may not exceed the agreed purpose or method and must return or delete the data when the entrustment ends. |
 Côte d'Ivoire |
Law No. 2013-450 on the Protection of Personal Data |
Choose a subcontractor who gives sufficient guarantees for the protection and security of the data, and ensure the subcontractor complies with this Law. |
 New Hampshire |
New Hampshire Data Privacy Act (NHDPA), general applicability and controller and processor duties |
Confirm a processor you use acts only on your instructions and assists with rights requests, security, and breach notification. |
 Somalia |
Data Protection Act No. 005 of 2023 |
Keep a record of every data processor handling personal data you control, and take reasonable measures to ensure each one processes in a way that keeps you compliant. |
Security baseline statutes
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Israel |
Privacy Protection Regulations (Data Security), information security programme |
Where an external service provider is given access to the database, agree in writing on the data and systems it may access, its reporting and data-destruction duties, and monitor its compliance. |
 North Carolina |
Identity Theft Protection Act, destruction of personal information records |
Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance. |
Sector security regimes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 New York |
New York Department of Financial Services Cybersecurity Regulation, Third-Party Service Provider Security Policy |
Address in those policies, to the extent applicable: the identification and risk assessment of third-party service providers; the minimum cybersecurity practices they must meet to do business with you; the due diligence you use to evaluate the adequacy of their cybersecurity practices; and periodic assessment of them based on the risk they present and the continued adequacy of their practices. |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.