unified
UC-DATA-05 — Provide privacy notices and transparency to data subjects
Publish and maintain privacy notices that describe, in clear and plain language, the categories of personal data collected, purposes, lawful bases, recipients, retention periods, and data-subject rights, and deliver them at or before the point of collection. Update and re-communicate notices in a timely manner when practices change, and publish any legally required registrations such as system-of-records notices. Retain dated notice versions as evidence.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Data Protection & Privacy
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-DATA-05
- title
- Provide privacy notices and transparency to data subjects
- statement
- Publish and maintain privacy notices that describe, in clear and plain language, the categories of personal data collected, purposes, lawful bases, recipients, retention periods, and data-subject rights, and deliver them at or before the point of collection. Update and re-communicate notices in a timely manner when practices change, and publish any legally required registrations such as system-of-records notices. Retain dated notice versions as evidence.
- domain
- Data Protection & Privacy
- control_type
- preventive
- control_category
- administrative
- members
- framework
- nist-800-53
- control_id
- PT-5
- coverage
- full
- relationship
- superset_of
- framework
- nist-800-53
- control_id
- PT-6
- coverage
- full
- relationship
- superset_of
- framework
- soc2
- control_id
- P1.1
- coverage
- full
- relationship
- superset_of
- framework
- gdpr
- control_id
- GDPR-Art12-14
- coverage
- partial
- delta
- controller/DPO identity, complaint right, transfer info, automated-decision disclosures, Art 14 source omitted
- relationship
- intersects_with
- framework
- hipaa
- control_id
- HIPAA-164.520
- coverage
- partial
- delta
- NPP-specific content (header, complaint process, duties, effective date) and acknowledgment mechanics omitted
- relationship
- intersects_with
- framework
- ccpa
- control_id
- CCPA-1798.100
- coverage
- partial
- delta
- beyond notice-at-collection: 1798.100 general duties (purpose limitation, reasonable security, contractor requirements) and verified right-to-know fulfillment satisfied by companion privacy-rights and security controls
- relationship
- intersects_with
- guidance
Source
No record-specific source URL is provided.
Connections
- Privacy Safeguards & Notice Management operates UC-DATA-05 — Provide privacy notices and transparency to data subjects
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to PT-5 — Privacy Notice
- framework
- nist-800-53
- control_id
- PT-5
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects mitigates Privacy-program non-compliance (GDPR, CCPA, state laws)
- strength
- related
- rationale
- Maintaining legally-required notices and registrations addresses the inadequate-notice driver of regulatory non-compliance.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects mitigates Inadequate transparency, notice and deceptive privacy communications
- strength
- primary
- rationale
- Publishing clear, timely, plain-language notices at/before collection directly counters inadequate/late transparency and non-disclosure of practices.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects mitigates Power imbalance and loss of self-determination over personal data
- strength
- related
- rationale
- Disclosing purposes, recipients, retention, and rights reduces the informational asymmetry between organization and individual.
- SOC 2 Privacy Criteria Assessment tests UC-DATA-05 — Provide privacy notices and transparency to data subjects
- UC-DATA-05 — Provide privacy notices and transparency to data subjects mitigates Erosion of individual trust and confidence in data practices
- strength
- related
- rationale
- Transparent, current notices meet reasonable privacy expectations, sustaining confidence in data practices.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to GDPR-Art12-14 — Transparency and information to data subjects
- framework
- gdpr
- control_id
- GDPR-Art12-14
- coverage
- partial
- delta
- controller/DPO identity, complaint right, transfer info, automated-decision disclosures, Art 14 source omitted
- relationship
- intersects_with
- source_version
- Regulation (EU) 2016/679
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to P1.1 — The entity provides notice to data subjects about its privacy practices to meet the entity's objectives related to privacy. The notice is updated and communicated to data subjects in a timely manner for changes to the entity's privacy practices, including changes in the use of personal information, to meet the entity's objectives related to privacy.
- framework
- soc2
- control_id
- P1.1
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2017 TSC
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to PT-6 — System of Records Notice
- framework
- nist-800-53
- control_id
- PT-6
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to CCPA-1798.100 — Notice at collection and consumer right to know
- framework
- ccpa
- control_id
- CCPA-1798.100
- coverage
- partial
- delta
- beyond notice-at-collection: 1798.100 general duties (purpose limitation, reasonable security, contractor requirements) and verified right-to-know fulfillment satisfied by companion privacy-rights and security controls
- relationship
- intersects_with
- source_version
- CCPA (2018) as amended by CPRA (2020)
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-DATA-05 — Provide privacy notices and transparency to data subjects maps_to HIPAA-164.520 — Notice of privacy practices for PHI
- framework
- hipaa
- control_id
- HIPAA-164.520
- coverage
- partial
- delta
- NPP-specific content (header, complaint process, duties, effective date) and acknowledgment mechanics omitted
- relationship
- intersects_with
- source_version
- 45 CFR Parts 160/164 (Security, Privacy, Breach Notification)
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.