Privacy Frameworks and Principles: FIPPs, OECD Principles and NIST/NICE

Privacy Frameworks and Principles: FIPPs, OECD Principles and NIST/NICE – A Complete CIPT Guide

Introduction
Privacy technologists do not invent privacy requirements from scratch. They translate a long line of internationally recognized frameworks and principles into system designs, controls and day-to-day engineering decisions. The CIPT (Certified Information Privacy Technologist) exam covers this topic in the domain on the privacy technologist's role in the organization. You are expected to recognize the major frameworks, understand where they came from and how they relate to each other, and apply them to realistic technology scenarios.

This guide covers four frameworks:
• FIPPs (Fair Information Practice Principles)
• OECD Privacy Guidelines and their eight principles
• NIST Privacy Framework
• NICE Workforce Framework

For each one, it explains why it matters, what it is, how it works and how to answer exam questions about it.

1. Why Privacy Frameworks and Principles Matter
• A common language. Legal, compliance, security, engineering and business teams often talk past each other. Frameworks give everyone shared vocabulary such as 'purpose specification', 'data minimization' and 'Govern-P'. Requirements can then move from policy into code.
• The foundation of modern law. Most privacy laws are built on FIPPs and OECD-style principles. These include the GDPR, PIPEDA, the US Privacy Act of 1974, APEC-based regimes, Australia's Privacy Principles and many US state laws. If you understand the principles, you can reason about almost any law, even one you have not studied.
• Technology neutrality. Principles are written to outlast specific technologies. They apply equally to cloud computing, IoT, AI and biometrics.
• Risk management and accountability. Frameworks like NIST's turn abstract principles into measurable outcomes, maturity tiers and profiles. Organizations can then assess gaps, prioritize investment and show accountability to regulators.
• Workforce clarity. NICE defines the tasks, knowledge and skills behind privacy and cybersecurity work. This supports hiring, training and defining the privacy technologist's role.
• Privacy by Design. Principles are the 'requirements source' that technologists use when they embed privacy into the system development lifecycle (SDLC).

2. Fair Information Practice Principles (FIPPs)
What they are: FIPPs are a set of widely accepted principles for the fair handling of personal information. The term describes a family of related principle sets rather than one fixed document.

Origins: the 1973 US HEW Report
The US Department of Health, Education and Welfare (HEW) published Records, Computers and the Rights of Citizens in 1973. It is generally credited as the origin of FIPPs. Its five core principles were:
1. There must be no personal data record-keeping systems whose very existence is secret.
2. Individuals must have a way to find out what information about them is in a record and how it is used.
3. Individuals must have a way to prevent information obtained for one purpose from being used for other purposes without their consent.
4. Individuals must have a way to correct or amend a record of identifiable information about them.
5. Any organization creating, maintaining, using or disseminating identifiable personal data must assure the data is reliable for its intended use and must take precautions to prevent misuse.

The HEW report directly influenced the US Privacy Act of 1974, which governs federal agency records.

FTC version of FIPPs (US commercial context, late 1990s)
• Notice/Awareness: consumers are told about practices before data is collected. This is considered the most fundamental FTC principle.
• Choice/Consent: consumers choose how their data is used, through opt-in or opt-out.
• Access/Participation: consumers can view their data and contest its accuracy or completeness.
• Integrity/Security: data is kept accurate and protected against unauthorized access.
• Enforcement/Redress: mechanisms exist to make sure the principles are followed. These include self-regulation, private remedies and government enforcement.

DHS / federal FIPPs
The US federal government also uses an eight-principle version, for example in DHS guidance and OMB Circular A-130. Its principles are:
• Transparency
• Individual Participation
• Purpose Specification
• Data Minimization
• Use Limitation
• Data Quality and Integrity
• Security
• Accountability and Auditing

How FIPPs work in practice
FIPPs are not a checklist with legal force by themselves. They are normative guidance that becomes binding when laws, regulations, contracts or policies adopt them. A privacy technologist applies FIPPs by turning each principle into concrete measures:
• Notice: privacy notices, just-in-time notices and layered notices.
• Choice: consent management platforms and preference centers.
• Access: data subject request portals.
• Security: encryption and access controls.
• Accountability: logging and audit trails.

3. OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data
What they are: The Organisation for Economic Co-operation and Development adopted these guidelines in 1980 and revised them in 2013. They are the most internationally influential statement of FIPPs. They aimed to protect privacy while preventing unjustified barriers to cross-border data flows, so they balance privacy with the free flow of information.

The eight OECD principles
1. Collection Limitation: there should be limits to the collection of personal data. Data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.
2. Data Quality: personal data should be relevant to its purposes and should be accurate, complete and kept up to date as necessary for those purposes.
3. Purpose Specification: purposes should be specified no later than the time of collection. Later use should be limited to those purposes or compatible ones.
4. Use Limitation: data should not be disclosed or used for other purposes except with the consent of the data subject or by authority of law.
5. Security Safeguards: reasonable safeguards should protect data against loss, unauthorized access, destruction, use, modification or disclosure.
6. Openness: there should be a general policy of openness about developments, practices and policies relating to personal data. This includes the identity and location of the data controller.
7. Individual Participation: individuals have the right to:
  • confirm whether the controller holds their data;
  • have it communicated to them within a reasonable time and in an intelligible form;
  • be given reasons if a request is denied, and be able to challenge the denial;
  • challenge the data and have it erased, rectified, completed or amended.
8. Accountability: the data controller should be accountable for complying with measures that give effect to the principles.

Memory aid: 'C-D-P-U-S-O-I-A' (Collection, Data quality, Purpose, Use, Security, Openness, Individual participation, Accountability). One mnemonic is 'Can Data Professionals Use Security Openly In Accountability?'

2013 revisions
The eight principles were kept. The revision added:
• implementation of privacy management programs, which strengthens accountability;
• data security breach notification to authorities and individuals;
• national privacy strategies;
• privacy enforcement authorities;
• risk-based approaches;
• improved global interoperability for transborder flows.

Influence
The OECD principles shaped:
• Council of Europe Convention 108 (1981)
• the EU Data Protection Directive 95/46/EC and then the GDPR
• Canada's PIPEDA
• Australia's privacy law
• the APEC Privacy Framework (2004), which adds principles such as 'Preventing Harm' and 'Choice'

Mapping OECD principles to technology
• Collection Limitation → data minimization in forms and APIs, collecting only required fields.
• Data Quality → validation rules, data hygiene and synchronization.
• Purpose Specification → data inventories and tagging data with purpose metadata.
• Use Limitation → purpose-based access control and policy enforcement points.
• Security Safeguards → encryption, IAM, logging and DLP.
• Openness → privacy notices and transparency reports.
• Individual Participation → DSAR workflows and self-service dashboards.
• Accountability → privacy program governance, DPIAs, audits and records of processing.

4. NIST Privacy Framework
What it is: The US National Institute of Standards and Technology published The NIST Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management, Version 1.0 in January 2020. NIST has since worked on an update to align it with Cybersecurity Framework 2.0. Key characteristics:
• It is voluntary, outcome-based, risk-based and law-agnostic.
• It is modeled on the NIST Cybersecurity Framework (CSF), so the two can be used together.

Core concept: privacy risk
NIST frames privacy risk as problems individuals may experience from data processing. Examples are dignity harms, discrimination, economic loss and loss of trust. These problems then cause organizational impacts. Privacy risk is distinct from cybersecurity risk but overlaps with it:
• Cybersecurity risk comes from loss of confidentiality, integrity or availability.
• Privacy risk can arise even from authorized processing. A common example is invasive inferences drawn from data the organization was allowed to use.
• The overlap between the two is cybersecurity-related privacy events, such as data breaches.

Three main parts
1. Core: a set of privacy activities and outcomes organized as Functions → Categories → Subcategories.
2. Profiles: a selection of Core Functions, Categories and Subcategories prioritized for an organization. A Current Profile is compared with a Target Profile to identify gaps.
3. Implementation Tiers: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They describe how mature and sophisticated an organization's privacy risk management is. Tiers are not maturity levels to be reached in strict sequence.

The five Core Functions (Version 1.0)
• Identify-P: develop organizational understanding of privacy risk from data processing. This covers inventory and mapping, business environment, risk assessment and data processing ecosystem risk management.
• Govern-P: develop and implement governance structure for ongoing privacy risk management. This covers policies, processes and procedures, risk management strategy, awareness and training, and monitoring and review.
• Control-P: develop and implement activities so that organizations or individuals can manage data with enough granularity to manage privacy risks. This covers data processing policies, data processing management, and disassociated processing.
• Communicate-P: develop and implement activities so that organizations and individuals have reliable understanding of, and engage in dialogue about, how data is processed and the associated risks. This covers communication policies, data processing awareness and transparency.
• Protect-P: develop and implement data processing safeguards. This covers identity management, authentication and access control, data security, maintenance and protective technology.

Relationship to the Cybersecurity Framework
• Identify-P, Govern-P, Control-P and Communicate-P address privacy risks from data processing.
• Protect-P overlaps with cybersecurity.
• For cybersecurity-related privacy events, organizations can also use the CSF Functions Detect, Respond and Recover.

Related NIST resources
• NIST IR 8062 introduces the privacy engineering objectives:
  • Predictability: reliable assumptions about processing.
  • Manageability: granular administration, such as alteration, deletion and selective disclosure.
  • Disassociability: processing without association to individuals beyond operational needs.
  These are analogous to the security triad of confidentiality, integrity and availability.
• NIST SP 800-53 Rev. 5 integrates privacy controls into its security and privacy control catalog, including the PT (PII Processing and Transparency) family.
• NIST SP 800-122 covers protecting the confidentiality of PII.
• NIST SP 800-37 is the Risk Management Framework.

How it works in practice
A privacy technologist might proceed in five steps:
1. Map data flows (Identify-P).
2. Build a Current Profile.
3. Agree a Target Profile with leadership based on legal requirements and risk appetite.
4. Perform a gap analysis.
5. Implement controls, for example de-identification under Control-P, notices under Communicate-P and encryption under Protect-P, then monitor them under Govern-P.

5. NICE Workforce Framework for Cybersecurity
What it is: NICE stands for the National Initiative for Cybersecurity Education, a program led by NIST. Its framework is published as NIST SP 800-181. Revision 1 appeared in 2020 as the Workforce Framework for Cybersecurity. It gives a common lexicon for describing cybersecurity work and the people who do it, across government, industry and academia.

Building blocks
• Task statements: the work to be done.
• Knowledge statements: what a person needs to know.
• Skill statements: what a person needs to be able to do. The 2017 version also included Abilities, giving the acronym KSAs.
• Work Roles: groupings of tasks that make up a role.
• Competencies: broader groupings of knowledge and skills used for assessment and learning.

Structure
The 2017 version (SP 800-181 Rev. 0) organized work into seven categories:
• Securely Provision
• Operate and Maintain
• Oversee and Govern
• Protect and Defend
• Analyze
• Collect and Operate
• Investigate

It defined specialty areas and work roles within these categories, including a Privacy Officer/Privacy Compliance Manager role under Oversee and Govern. Later updates of the NICE Framework components reorganized the work roles into new categories.

Why it matters to privacy technologists
• It clarifies who does what. Privacy technologists can define job descriptions, identify training needs and build career pathways.
• It shows where privacy responsibilities sit alongside security roles.
• NIST also convened a Privacy Workforce Public Working Group to develop privacy-specific Task, Knowledge and Skill statements aligned to the NIST Privacy Framework. This links the 'what' (Privacy Framework outcomes) to the 'who' (workforce roles).

6. How the Frameworks Fit Together
• FIPPs: the philosophical and ethical foundation. They answer: what does fair handling of personal data look like?
• OECD Guidelines: the internationally agreed articulation of FIPPs. It is the basis for laws worldwide and balances privacy with transborder data flows.
• NIST Privacy Framework: an operational, risk-based tool. It answers: how do we manage privacy risk and achieve outcomes across the enterprise?
• NICE Framework: the workforce layer. It answers: who has the tasks, knowledge and skills to do this work?

Think of it as a progression: Principles → Laws → Risk management → People. Related frameworks you may also see include:
• the APEC Privacy Framework and its Cross-Border Privacy Rules (CBPR);
• Privacy by Design's seven foundational principles (Ann Cavoukian);
• ISO/IEC 29100 privacy framework and ISO/IEC 27701;
• the AICPA/CICA Generally Accepted Privacy Principles (GAPP), with 10 principles.

7. How to Answer Exam Questions on This Topic
CIPT questions are usually scenario-based. They test whether you can recognize which principle or framework element applies to a technology situation.

Step 1: Identify what is being asked. Is the question about:
• a principle (e.g., purpose specification vs. use limitation)?
• a framework component (e.g., Core vs. Profile vs. Tier)?
• history or origin (e.g., HEW 1973, OECD 1980)?
• a workforce concept (NICE)?

Step 2: Find the trigger words in the scenario.
• 'Only collect what is needed' or 'excessive form fields' → Collection Limitation, or Data Minimization in DHS FIPPs.
• 'Data used for marketing that was collected for billing' → Use Limitation. Purpose Specification is the principle that defined the original purpose.
• 'Inaccurate or outdated records' → Data Quality.
• 'Customers cannot see what is held about them' → Individual Participation, or Access/Participation in the FTC version.
• 'No one knows the company processes this data' or 'secret databases' → Openness/Transparency.
• 'Encryption, unauthorized access, breach' → Security Safeguards, or Protect-P in NIST.
• 'Who is responsible?' or 'a privacy program must demonstrate compliance' → Accountability.
• 'Data inventory and mapping' → NIST Identify-P.
• 'Policies, training, risk strategy' → NIST Govern-P.
• 'De-identification, granular data management, disassociated processing' → NIST Control-P.
• 'Transparency, notices, dialogue with individuals' → NIST Communicate-P.
• 'Compare where we are with where we want to be' → NIST Profiles (Current vs. Target).
• 'How sophisticated is our risk management?' → NIST Implementation Tiers.
• 'Define job roles, tasks, knowledge and skills' → NICE Framework.

Step 3: Eliminate distractors. Wrong answers are often real principles from a different framework, or a neighboring principle. Purpose Specification and Use Limitation are the most commonly confused pair:
• Purpose Specification means declaring the purpose at or before collection.
• Use Limitation means not using or disclosing data beyond that purpose without consent or legal authority.

Step 4: Choose the most specific, best-fit answer. If a scenario fits several principles, pick the one that most directly addresses the root issue described.

Exam Tips: Answering Questions on Privacy Frameworks and Principles: FIPPs, OECD Principles and NIST/NICE
Memorize these lists and dates:
• The eight OECD principles, in order. Know that the guidelines date from 1980 and were revised in 2013, and that the 2013 additions were privacy management programs and breach notification.
• The HEW report (1973) as the origin of FIPPs and its link to the Privacy Act of 1974.
• The five FTC FIPPs: Notice, Choice, Access, Security, Enforcement. Notice is considered the most fundamental.
• The five NIST Privacy Framework Functions: Identify-P, Govern-P, Control-P, Communicate-P, Protect-P. Watch for the '-P' suffix. Detect, Respond and Recover belong to the Cybersecurity Framework.
• The three NIST Privacy Framework parts (Core, Profiles, Implementation Tiers) and the four Tiers (Partial, Risk Informed, Repeatable, Adaptive).
• The privacy engineering objectives from NIST IR 8062: Predictability, Manageability, Disassociability, the privacy counterpart to confidentiality, integrity and availability.
• NICE = National Initiative for Cybersecurity Education, NIST SP 800-181, built on Task, Knowledge and Skill (TKS) statements and Work Roles.

Remember these key distinctions:
• The NIST Privacy Framework is voluntary and not a law. It is not a compliance certification, and it is designed to be law-agnostic and technology-neutral.
• Privacy risk can arise from authorized processing. Questions that treat privacy as purely a security issue are often traps.
• NICE is about the workforce, not data processing controls. If a question asks about staffing, training or role definitions, think NICE. If it asks about privacy outcomes, think NIST Privacy Framework.

Exam technique:
• Translate technology into principles. Ask yourself: 'What principle would this system feature satisfy?' For example, a consent dashboard serves Choice and Individual Participation, and data retention schedules serve Use Limitation and Data Quality.
• Watch for absolute words such as 'always', 'never' and 'only'. Principles are usually qualified with phrases like 'where appropriate' and 'reasonable safeguards'.
• When two answers both look right, prefer the one stated at the level the question asks about: principle vs. law vs. control.
• Read the full scenario before answering. Detail such as 'collected for one purpose, now used for another' changes the answer from Collection Limitation to Use Limitation.

Sample question 1
A retailer collected email addresses for order confirmations and now wants to share them with an advertising partner. Which OECD principle is most directly at issue?
• Answer: Use Limitation. The data would be disclosed for a purpose other than the one specified, without consent.

Sample question 2
An organization wants to compare its existing privacy activities against desired outcomes to prioritize improvements. Which NIST Privacy Framework component should it use?
• Answer: Profiles (Current Profile vs. Target Profile).

Sample question 3
Which NIST Privacy Framework Function covers data inventory and mapping?
• Answer: Identify-P.

Summary
FIPPs supply the ethical foundation and the OECD Guidelines turned it into global principles. The NIST Privacy Framework turns those principles into risk-based outcomes, and NICE defines the workforce needed to deliver them. To answer exam questions:
• know the lists;
• understand how the frameworks relate;
• map scenario trigger words to the correct principle or function;
• carefully separate commonly confused pairs such as Purpose Specification vs. Use Limitation and Privacy Framework vs. Cybersecurity Framework.