.png) # DPMP: Data Privacy Management Principles The Data Privacy Management Principles (DPMP) provide a “best in class” set of data privacy principles mapped to 31 leading privacy frameworks worldwide. The DPMP is included as a tab within the SCF download spreadsheet, giving organizations a unified privacy language alongside the Common Controls Framework™. 86 Privacy Principles 11 Privacy Domains 31 Frameworks Mapped FREE Included in SCF Download ## Solving the “Apples to Oranges” Privacy Framework Problem Many cybersecurity and even privacy professionals have a hard time identifying “what right looks like” when picking a set of privacy principles for an organization to align to. The DPMP solves this by creating a unified, “best in class” approach to managing privacy expectations. In support of the Secure, Compliance & Resilient (SCR) initiative, a volunteer effort created the SCF Data Privacy Management Principles (DPMP). When you tie the broader SCR in with these data privacy management principles, you have an excellent foundation for building and maintaining secure systems, applications and services that address cybersecurity and data privacy considerations by default and by design. The SCF team selected over a dozen of the most common privacy frameworks and created a set of simplified, yet comprehensive, privacy management principles. The best part is these are all mapped to the SCF, so you can leverage the SCF for both your cybersecurity and privacy needs. **The end result is the SCF's Data Privacy Management Principles (the DPMP is a tab that is part of the SCF download).** ### DPMP Domains ## 86 Principles Across 11 Privacy Domains The DPMP organizes 86 privacy principles into 11 domains that cover the complete lifecycle of data privacy management, from privacy by design through business environment considerations. ### 1. Privacy by Design Principles ensuring that data privacy is embedded into the design and architecture of systems, applications and business practices from the ground up, not bolted on as an afterthought. ### 2. Data Subject Participation Principles governing how organizations engage data subjects in the collection, use and management of their personal information, ensuring active participation and informed consent. ### 3. Limited Collection & Use Principles that restrict the collection of personal data to what is necessary for a specified purpose and limit the use of that data to the purposes for which it was collected. ### 4. Transparency Principles requiring organizations to be open and clear about their data privacy practices, policies and procedures, enabling data subjects to make informed decisions about their personal information. ### 5. Data Lifecycle Management Principles addressing the management of personal data throughout its entire lifecycle, from collection and processing through storage, retention and secure disposal. ### 6. Data Subject Rights Principles ensuring organizations respect and implement data subject rights including access, correction, deletion, portability and the right to object to processing. ### 7. Security by Design Principles ensuring appropriate administrative, technical and physical safeguards are implemented to protect personal data against unauthorized access, disclosure, alteration and destruction. ### 8. Incident Response Principles governing how organizations detect, respond to and recover from data privacy incidents, including breach notification requirements and remediation procedures. ### 9. Risk Management Principles addressing the identification, assessment and treatment of privacy-related risks, including Data Protection Impact Assessments (DPIAs) and ongoing risk monitoring. ### 10. Third-Party Management Principles governing the management of third-party relationships where personal data is shared, processed or stored, including vendor due diligence, contractual obligations and ongoing oversight. ### 11. Business Environment Principles addressing the organizational and governance context in which privacy operates, including leadership commitment, program governance, training and accountability structures. ## Mapped to 31 Leading Privacy Frameworks The DPMP was created by analyzing over a dozen of the most common privacy frameworks, looking for similarities and gaps to create a comprehensive set of unified principles. Every DPMP principle includes direct mappings to its source frameworks. ### International & Industry Standards AICPA TSC 2017:2022 (SOC 2), APEC Privacy Framework 2015, Generally Accepted Privacy Principles (GAPP), ISO 27701:2025, ISO 29100:2024, NIST Privacy Framework 1.0, NIST 800-53 R5, NIST CSF 2.0, OECD Privacy Principles. ### US Federal & State Laws Data Privacy Framework (DPF), Fair Information Practice Principles (FIPPs), HIPAA Administrative Simplification 2013, Alaska PIPA, California CCPA/CPRA, Colorado Privacy Act, Illinois BIPA, Illinois Identity Protection Act, Illinois PIPA, Nevada SB220, Oregon Consumer Privacy Act, Tennessee Information Protection Act, Texas BC521, Virginia CDPA 2025, Vermont Act 171. ### EMEA & APAC & Americas EU General Data Protection Regulation (GDPR), Saudi Arabia PDPL, Australia Privacy Act, Australian Privacy Principles, India DPDPA 2023, New Zealand Privacy Act of 2020, Canada PIPEDA. ## Continuous Improvement ### Plan-Do-Check-Act (PDCA) The DPMP is designed to operate within a continuous PDCA improvement cycle, enabling organizations to systematically advance their data privacy management practices over time. P ### PLAN Identify applicable privacy frameworks from the 31 mapped in the DPMP. Determine which of the 86 principles apply to your organization based on jurisdictional and industry requirements. Define privacy targets aligned with the 11 domains. D ### DO Implement the applicable DPMP principles through the linked SCF controls. Use the SCF control catalog to operationalize privacy requirements across people, processes and technology. Document implementation evidence. C ### CHECK Assess the effectiveness of implemented privacy controls using SCR-CMM maturity levels. Review compliance against mapped frameworks. Identify gaps between current privacy posture and organizational targets across all 11 domains. A ### ACT Update privacy controls and procedures based on assessment findings. Address new privacy framework requirements as they emerge. Advance maturity levels for privacy-related controls. Incorporate lessons learned into the privacy program roadmap.