Law / Frameworks / NIST Privacy Framework / Protect-P

NIST Privacy Framework, Protect-PPR.DS-P3

Systems/products/services and associated data are formally managed throughout removal, transfers, and disposition.NIST Privacy Framework, version 1.0, January 2020, PR.DS-P3

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

3: laws
3: jurisdictions
1: with court rulings behind it
0: not yet in force

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST CSF 2.0ID.AM-08 Systems, hardware, software, services, and data are managed throughout their..., 2 laws
FINOS AIGFAIR-DET-004 AI System Observability, 2 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 2 laws

Breach notification

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Arkansas	Arkansas Personal Information Protection Act, breach notification and security	Implement and maintain reasonable security procedures and practices to protect Arkansas residents' personal information, and dispose of records containing it in a manner that renders the information unreadable or undecipherable.

Security baseline statutes

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Kuwait	Data Classification Policy	Transfer or remove Tier 3 and Tier 4 data from a data center's or server's storage before decommissioning that equipment.

Sensitive categories

1 law, 1 jurisdiction

Jurisdiction	Law	What it asks, as read here
Ontario	Personal Health Information Protection Act, 2004, custodian and agent duties: consent, safeguards, information practices and marketing	Retain, transfer and dispose of records of personal health information in a secure manner and in accordance with the prescribed requirements.

Full text of the NIST Privacy Framework, public domain (a US government work). Every control of the framework.