Framework AI Governance & Privacy Frameworks
The NIST Privacy Framework is a voluntary US tool for managing the privacy risks that arise from how an organization processes personal data.
Version 1.0 was published in January 2020 and is built like the NIST Cybersecurity Framework: a Core of functions (Identify-P, Govern-P, Control-P, Communicate-P, and Protect-P), Profiles that describe current and target states, and Implementation Tiers.
NIST released an initial public draft of version 1.1 on April 14, 2025 to line the framework up with CSF 2.0 and the AI RMF, with a section on AI privacy risks; final publication was signaled for 2026 (verify current status on the NIST page).
The framework itself imposes nothing, but organizations that adopt it end up producing a data inventory and data flow maps, a privacy governance policy with assigned roles, privacy risk assessments, a record of the controls chosen to manage each risk, notices and consent mechanisms, and processes for handling individual requests and incidents.
It is commonly used to structure compliance with US state privacy laws, GDPR, and sector rules, and to support ISO/IEC 27701 work.
Voluntary. Any organization processing personal data. It is referenced by some US state laws and regulators as an acceptable structure for a privacy program but is not mandated.
Data inventory and processing maps; privacy governance policy and role assignments; privacy risk assessment method and results; control selections tied to risks; privacy notices and consent records; data subject request handling logs; vendor and processor agreements; incident and breach handling records; training records; management review of the target Profile.
Where the requirement sits: Privacy Framework 1.0 Identify-P / Govern-P / Control-P / Communicate-P / Protect-P
The initial public draft of Privacy Framework 1.1 was issued April 14, 2025 with comments accepted until June 13, 2025. It keeps the 1.0 structure, realigns with Cybersecurity Framework 2.0, and adds AI-related privacy content. Check the NIST Privacy Framework page for whether the final version has been published.
Organise privacy policies against the framework.
AllyMatter publishes this site.
Assessors
None. No certification exists. Organizations self-assess or have privacy controls examined as part of another engagement such as a SOC 2 privacy criteria report or ISO/IEC 27701 audit.
No firm has claimed a NIST Privacy Framework assessor listing yet. Claim yours →
Consultants
Privacy consultancies, law firms, and GRC platform vendors offer mapping and program-build services. Typical engagement is a gap assessment against the Core, a data inventory exercise, and drafting of the governance policy and risk register, followed by a target Profile and roadmap.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies NIST Privacy Framework asks for, keep every version, and record a named acknowledgment from each person who has to read them.