Law / Frameworks / NIST Privacy Framework / Protect-P
NIST Privacy Framework, Protect-PPR.AC-P2
Physical access to data and devices is managed.NIST Privacy Framework, version 1.0, January 2020, PR.AC-P2
We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of .
- 6
- laws
- 6
- jurisdictions
- 0
- with court rulings behind them
- 0
- not yet in force
Related controls in other frameworks the same duties, in at least two laws we track, reach both
- FINOS AIGFAIR-PREV-007 Legal and Contractual Frameworks for AI Systems, 2 laws
- FINOS AIGFAIR-PREV-008 Quality of Service (QoS) and DDoS Prevention for AI Systems, 2 laws
- FINOS AIGFAIR-PREV-012 Role-Based Access Control for AI Data, 2 laws
- 4 more in the FINOS AIGF
Comprehensive regime
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Côte d'Ivoire |
Law No. 2013-450 on the Protection of Personal Data |
Prevent unauthorized access to the installations and data used for processing, guard against the processing being used for money laundering or terrorist financing, and keep backup copies for security. |
 Tunisia |
Organic Act on the Protection of Personal Data |
Take all necessary precautions to secure personal data against unauthorized modification, alteration or consultation, including physical access controls, a log of who accessed the system and when, and secure backup copies. |
Sensitive categories
2 laws, 2 jurisdictions| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Cabo Verde |
Law No. 133/V/2001 on the Protection of Personal Data, offence registers and special security measures |
Take the additional information security measures Article 25 lists for special-category and criminal-record data, including controlling entry to processing premises, controlling who can read, copy or alter data carriers, controlling use of and access to the processing systems, and logically separating health and sex life data, including genetic data, from other personal data. |
 Sao Tome and Principe |
Lei n.º 03/2016, sensitive categories and suspect records |
Put in place the special safety measures the Law requires of a controller that processes sensitive data under Article 7(2) or keeps records of suspected unlawful activity under Article 8: control of premises entry, data-carrier handling, unauthorized disclosure, system access, transmission, and data-entry logging, and keep health and sex-life data logically separated from other personal data. |
Biometric privacy
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Vietnam |
Law on Personal Data Protection, biometric and location data protection |
An app that collects or processes biometric data, meaning physical attributes and unique, stable biological characteristics used to identify a person, from an individual in Vietnam must apply physical security measures, limit access, and maintain a monitoring system to detect infringement, and must notify the data subject where its processing damages that person. |
Security baseline statutes
1 law, 1 jurisdiction| Jurisdiction | Law | What it asks, as read here |
|---|---|---|
 Montenegro |
Law on Information Security, General Security Measures |
Physically secure the premises, spaces and devices that house your network and information system (Article 14). |
Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.