Law / Frameworks / NIST Privacy Framework / Identify-P

NIST Privacy Framework, Identify-PID.IM-P6

Data elements within the data actions are inventoried.NIST Privacy Framework, version 1.0, January 2020, ID.IM-P6

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Corpus as of 29 Sep 2026.

5: laws
5: places
0: with court rulings behind them
1: not yet in force

The same ground elsewhere linked through the kinds of duty both controls are mapped from

NIST AI RMFMAP 3.5 Processes for human oversight are defined, assessed, and documented in accordance with...
NIST AI RMFMEASURE 2.10 Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
NIST AI 600-1GAI-RISK-04 Data Privacy
NIST AI 600-1GAI-RISK-07 Human-AI Configuration
MIT mitigations3.2 Data Governance
MIT mitigations3.3 Access Management

A law in force is unmarked; the rest wear their state: not yet in force

Sensitive categories

5 laws, 5 places

Place	Law	What it asks, as read here
Austria	GDPR Article 9, Special Categories of Personal Data Including Biometric Data, as Applied in Austria	Treat any biometric identifier your system derives through its own technical processing as special category data under Austrian and EU law alike, even where the underlying image or audio was lawfully public.
Germany	GDPR Article 9 and BDSG Section 26(3), Special Categories and Employment Biometric Data in Germany	Treat any biometric identifier your system derives through its own technical processing as GDPR Article 9 special category data, whether or not the source photo or audio was publicly available.
Michigan	Insurance Data Security Act, nonpublic information including biometric records	If you are a Michigan insurance licensee, treat a biometric record as nonpublic information requiring the chapter's data-security safeguards, alongside a Social Security number, driver's license number, or financial account number.
Mississippi	Insurance Data Security Law, nonpublic information including biometric records	If you are a Mississippi insurance licensee, treat a biometric record as nonpublic information requiring this law's data-security safeguards, alongside a Social Security number, driver's license number, or financial account number.
Montenegro	Law on Personal Data Protection, special categories of data from a date not yet set	Distinctively designate and protect special categories of data against unauthorised access, under Article 13.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.