{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Data Protection & Privacy","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-18","description":"Enter formal agreements before participating in automated matching of personal data between organizations or systems, specifying the purpose, data elements, and verification procedures. Provide any required notice, independently verify matched information before taking adverse action against an individual, and retain agreements and verification records as evidence.","details":{"control_category":"administrative","control_type":"preventive","domain":"Data Protection & Privacy","guidance":[],"members":[{"control_id":"PT-8","coverage":"full","framework":"nist-800-53","relationship":"equal"}],"statement":"Enter formal agreements before participating in automated matching of personal data between organizations or systems, specifying the purpose, data elements, and verification procedures. Provide any required notice, independently verify matched information before taking adverse action against an individual, and retain agreements and verification records as evidence.","title":"Govern automated matching of PII under formal agreements","unified_id":"UC-DATA-18"},"id":"uc:UC-DATA-18","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-DATA-18","sourceIds":["nist-800-53"],"sourceUrl":null,"title":"UC-DATA-18 — Govern automated matching of PII under formal agreements","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1ea5f00439d184a2dcc41b51a56df9fa3815876963257761e5158959d67b8377","properties":{"control_id":"PT-8","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"equal","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","sourceId":"uc:UC-DATA-18","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-pt-8-e547599b.json","targetId":"ctrl:nist-800-53:PT-8","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:869e04760e24f41a58e916cea038c419f95160ee480e05e06a2b0ae7234f1bb4","properties":{"rationale":"Required notice and human verification before adverse action reduce opaque automated decisioning over individuals.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","sourceId":"uc:UC-DATA-18","targetDetailPath":"/data/v1/records/risk-privacy-power-imbalance-self-determination-9112ad1d.json","targetId":"risk:privacy-power-imbalance-self-determination","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8c7c479dab3c6d9e5d65bbee464470d7d9f7d12db4e8225ef8e3f9cd171ff332","properties":{},"sourceDetailPath":"/data/v1/records/wf-r9-636a9e6e.json","sourceId":"wf:R9","targetDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","targetId":"uc:UC-DATA-18","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a4ffcd13da6d34d0736135d6b41a17de0c8d9b11d81c201350b277bc6a189bf3","properties":{"rationale":"Formal agreements specifying purpose, data elements, and verification establish documented authority for the inter-organization matching.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","sourceId":"uc:UC-DATA-18","targetDetailPath":"/data/v1/records/risk-tech-illegal-data-processing-859983e3.json","targetId":"risk:tech-illegal-data-processing","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5687e260d1fca0d2472f4d2b5548ff42a8543995b3e9265d47161b509a0773f","properties":{"rationale":"Independently verifying matched data before any adverse action directly prevents unwarranted restriction/denial of services from erroneous matches.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-18-1cee8070.json","sourceId":"uc:UC-DATA-18","targetDetailPath":"/data/v1/records/risk-data-privacy-harms-to-individuals-510e65af.json","targetId":"risk:data-privacy-harms-to-individuals","type":"mitigates"}],"schemaVersion":1}