NASA Procedural Requirements

NPR 1382.1B Effective Date: July 26, 2022 Expiration Date: July 26, 2027

Subject: NASA Privacy Procedural Requirements

Responsible Office: Office of the Chief Information Officer

Table of Contents

Preface

P.1 Purpose
P.2 Applicability
P.3 Authority
P.4 Applicable Documents and Forms
P.5 Measurement/Verification
P.6 Cancellation

Chapter 1. Privacy Management

1.1 Overview
1.2 Roles and Responsibilities

Chapter 2. Identify

2.1 Overview
2.2 Inventory
2.3 Privacy Threshold Analyses (PTA) and Privacy Impact Assessments (PIA)

Chapter 3. Govern

3.1 Overview
3.2 Awareness and Training
3.3 Privacy Accountability
3.4 Privacy Complaints
3.5 Privacy Consequences
3.6 Privacy Redress and Privacy Act Information Requests
3.7 Privacy Rules of Behavior
3.8 Risk Management Strategy

Chapter 4. Control

4.1 Overview
4.2 Collection of Personally Identifiable Information (PII) and sensitive PII

Chapter 5. Communicate

5.1 Overview
5.2 Computer Matching Agreements
5.3 Childrens Online Privacy Protection Act Notice
5.4 Privacy Act Statements
5.5 Privacy Act System of Records Notices
5.6 Privacy Notice
5.7 Web Measurement and Customization Technology Use and Notice

Chapter 6. Protect

6.1 Overview
6.2 Privacy and Information Security
6.3 Privacy Incident Response and Management

Appendix A. Definitions
Appendix B. Acronyms
Appendix C. Requirements Matrices

DISTRIBUTION:
NODIS

This document does not bind the public, except as authorized by law or as incorporated into a contract. This document is uncontrolled when printed. Check the NASA Online Directives Information System (NODIS) Library to verify that this is the correct version before use: https://nodis3.gsfc.nasa.gov.