X Marks the Spot

Using Privacy Framework 

Regulatory Crosswalks to Integrate 

Compliance and Risk 

Management

December 1, 2021
CCPA/CPRA/VCDPA 

Crosswalk

Jeewon Kim Serrato

BakerHostetler
3

Key US Privacy Laws

CA. CONSUMER PRIVACY 

ACT (CCPA) 2020

CA. PRIVACY RIGHTS ACT 

(CPRA) 

2023

VA. CONSUMER DATA 

PROTECTION ACT (VCDPA) 

2023

CO. PRIVACY ACT (COPA) 

2023
4

How does the NIST Privacy Framework Help? 

CCPA CPRA VCDPA COPA GDPR

Status 01/20 01/23 01/23 07/23 5/18

Notice Requirement

Right to Access

Right to Delete

Right to Correct

Right to Opt-Out of 

Sales

Consent / Opt-in

“Sensitive Data” Req.

Security Req.

Private Right Of Action

DPA Requirement

Enforcement (Fines) 

Cure 

SLIDE 3
5

How to 

develop a 

governance 

structure

• GOVERN-P (GV-P): Develop and 

implement the organizational 

governance structure to enable an 

ongoing understanding of the 

organization’s risk management 

priorities that are informed by privacy 

risk.
6

How to 

address 

legal risks

• GV.PO-P5: Legal, 

regulatory, and contractual

requirements regarding 

privacy are understood and 

managed.
7

Notice of 

Financial 

Incentive 

under 

CCPA

1798.125(b)(1): 

• A business may offer financial incentives, including payments to consumers as 

compensation, for the collection of 

personal information, the sale of personal information, or the deletion of personal information.

• A business may also offer a different 

price, rate, level, or quality of goods or 

services to the consumer if that price or difference is directly related to the value

provided to the business by the 

consumer’s data.
8

Profiling 

under 

VCDPA

• The VCDPA explicitly forbids the processing of 

personal data in violation of state and federal 

anti-discrimination laws and specifically allows 

consumers to opt-out of data processing that 

involves profiling.

• Controllers must also undertake “data protection 

assessments” that judge the benefits of data 

processing along with risks to the consumer. 

• Controllers must assess the processing of personal 

data used for profiling when there is a 

“reasonably foreseeable risk” that such profiling 

will lead to discriminatory impact; economic, 

reputational or actual harm; and invasions of 

privacy. 
9

Consent 

under 

COPA
10

How Do You Make the Framework Work for You?

Inventory (ID.IM-P1): 

Systems/products/services that 

process data are inventoried.

Data Mapping (ID.IM-P8): 

Data processing is mapped.

Risk Prioritization (ID.RA-P4): 

Problematic data actions, 

likelihoods, and impacts are 

used to determine and prioritize 

risk.
11

What does the Privacy Framework Not Do?

Create workflows for 

each legal regime

Operationalize legal 

requirements

Test and audit existing 

controls for effectiveness
12

Building a Future-Proof Privacy Program

Understand

Understand your 

data. Perform 

data mapping.

Communicate

Draft appropriate 

privacy policies 

and other 

disclosures 

regarding data 

use.

Govern

Ensure internal 

controls support 

public-facing 

disclosures.
GPDR Crosswalk

R. Jason Cronk

Enterprivacy Consulting Group
14

GDPR Crosswalk

NIST Privacy Framework CORE EU General Data Protection Regulation

Chapter II – Principles

Chapter III – Rights of the Data Subjects

Section 1 Transparency and Modalities

Section 2 Information and Access to Information

Section 3 Rectification and Erasure

Section 4 Right to object to automated decision making

Section 5 Restrictions

Chapter IV – Controllers and Processors

Section 1 General Obligations

Section 2 Security of Personal Data

Section 3 Data Protection Impact Assessments

Section 4 Data Protection Officers

Section 5 Certification and Codes of Conduct

Chapter V – Data Transfers
15

GDPR Crosswalk

NIST 800-53 ISO 27002

AC-1 9.1.1 Access control policy

Control

Develop, document, and disseminate 

to [Assignment: organization-defined 

personnel or

roles]:

1. [Selection (one or more): 

Organization-level; Mission/business 

process-level; Systemlevel] access 

control policy that:

Control

An access control policy should be 

established, documented and reviewed 

based on business and

information security requirements.
16

GDPR Crosswalk

Micosoft Data Protection/Privacy 

Mapping Project (dpmap.org)

NIST Privacy Framework CORE

ISO 27701

EU General Data Protection Regulation

Chapter II – Principles

Chapter III – Rights of the Data Subjects

Section 1 Transparency and Modalities

Section 2 Information and Access to Information

Section 3 Rectification and Erasure

Section 4 Right to object to automated decision making

Section 5 Restrictions

Chapter IV – Controllers and Processors

Section 1 General Obligations

Section 2 Security of Personal Data

Section 3 Data Protection Impact Assessments

Section 4 Data Protection Officers

Section 5 Certification and Codes of Conduct

Chapter V – Data Transfers
17

GDPR Crosswalk

NIST Privacy Framework CORE EU General Data Protection Regulation

Identify-P Breakfast

Govern-P

Control-P Dinner

Communicate-P

Protect-P Dessert
18

GDPR Crosswalk

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

Company Profile 

Blueberry Muffins

Blueberries

Flour

Water

Corn Bread

Corn Meal

Sugar

Salt

Milk

Jalapeños

Cupcakes

Sugar

Frosting

Strawberries

Dinner

Dessert

Breakfast
19

GDPR Crosswalk

Breakfast

Fruit

Sweet

Jalapeños

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

Company Profile 

Blueberry Muffins

Blueberries

Flour

Water

Corn Bread

Corn Meal

Sugar

Salt

Milk

Jalapeños

Cupcakes

Sugar

Frosting

Strawberries

Dinner

Dessert

Breakfast
20

GDPR Crosswalk

Article 35 DPIA

Article 5(1)(b) Purpose Limitation

Article 7 Conditions of Consent

Article 32(4) 

The controller and processor shall take steps 

to ensure that any natural person acting 

under the authority of the controller or the 

processor who has access to personal data 

does not process them except on instructions 

from the controller, unless he or she is 

required to do so by Union or Member State 

law.

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

ID.IM-P5: The purposes 

for the data actions are 

inventoried.

CT.PO-P1: Policies,

processes, and 

procedures for 

authorizing data 

processing (e.g., 

organizational decisions, 

individual consent), 

revoking authorizations, 

and maintaining 

authorizations are 

established and in 

place.
21

Profile 

GDPR Crosswalk

Article 35 DPIA

Article 5(1)(b) Purpose Limitation

Article 7 Conditions of Consent

Article 32(4) 

The controller and processor shall take steps 

to ensure that any natural person acting 

under the authority of the controller or the 

processor who has access to personal data 

does not process them except on instructions 

from the controller, unless he or she is 

required to do so by Union or Member State 

law.

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

ID.IM-P5: The purposes 

for the data actions are 

inventoried.

CT.PO-P1: Policies,

processes, and 

procedures for 

authorizing data 

processing (e.g., 

organizational decisions, 

individual consent), 

revoking authorizations, 

and maintaining 

authorizations are 

established and in 

place.

Policy: Princple of Least 

Priviledge

Procedure: systems 

requesting access to 

personal data ask, provide 

jusitifcation and be 

approved by internal data 

owners. Data owners 

review the request.
22

GDPR Crosswalk

Article 5(1)(f)

processed in a manner that 

ensures appropriate security of the 

personal data, including protection 

against unauthorised or unlawful 

processing and against accidental 

loss, destruction or damage, using 

appropriate technical or 

organizational measures ('integrity 

and confidentiality').

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

CM.AW-P2: Mechanisms for 

obtaining feedback from 

individuals (e.g., surveys or focus 

groups) about data processing 

and associated privacy risks are 

established and in place.
23

GDPR Crosswalk

Article 5(1)(f)

processed in a manner that 

ensures appropriate security of the 

personal data, including protection 

against unauthorised or unlawful 

processing and against accidental 

loss, destruction or damage, using 

appropriate technical or 

organizational measures ('integrity 

and confidentiality').

NIST Privacy Framework CORE EU General Data Protection Regulation

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P

CM.AW-P2: Mechanisms for 

obtaining feedback from 

individuals (e.g., surveys or focus 

groups) about data processing 

and associated privacy risks are 

established and in place.

appropriate
24

Using the GDPR Crosswalk to develop your Target 

Profile

Govern-P

Control-P

Communicate-P

Protect-P

Identify-P Chapter II – Principles

Chapter IV –

Controllers and 

Processors

Chapter V – Data 

Transfers

Chapter III – Rights of 

the Data Subjects

• Does GDPR support inclusion of 

a function, category or 

subcategory?

ART 32 Security of Processing ⇒

Protect-P

• Does GDPR mandate a specific 

control?

ART 37 DPO ⇒ GV.PO-P3 Roles 

and Responsibilities: Hire a DPO

• Is a specific control supportive 

of a GDPR obligation? 

CT.DM-P4: Data elements can 

be accessed for deletion ⇒

ART 17 Right of Erasure

Target Profile
LGPD Crosswalk

Paulo Vidigal

Prado Vidigal Advogados
26

Dealing with the LGPD may feel like ... 

Just like in the TV Series, we may feel that:

PLAYING THE SQUID GAME

• We are stuck in an unknown environment

• The rules are unclear and may change in the

middle of the game

• We cannot rely on anyone: other participants are

also new to the game

• We will soon be “eliminated”!
27

Can we pretend this is just like the GDPR?

Contracts: 

Controllers – Processors

Record of Data Processing 

Operations (ROPA)

Notification of Personal 

Data Time Limits

DSAR Response Time Limits

Appointment of DPO

Contract provisions are not 

specified (implicit obligation)

Content not specified

Reasonable time

15 days

Mandatory to all data 

controllers

Contract provisions detailed in 

Article 28

Content detailed in Article 30

72 hours

30 days +

Depending on the core 

processing activities
28

Can the NIST Privacy Framework help?

• act as the common language between different laws

The Privacy Framework can:

• help mitigate the principle-based nature of the LGPD and the lack of DPA

regulations

• add credibility to the organization’s privacy program
29

What about the LGPD Crosswalk?

IDENTIFY 

(ID-P)

Risk Assessment 

(ID.RA-P): 

The organization 

understands the 

privacy risks to 

individuals and 

how such privacy 

risks may create 

follow-on impacts 

on organizational 

operations (...)

ID.RA-P2: 

Data analytic 

inputs and 

outputs are 

identified and 

evaluated for 

bias.

FUNCTION CATEGORY SUBCATEGORY

NIST PRIVACY FRAMEWORK

Principle of 

Nondiscrimination

ARTICLE 6, IX

LGPD

Formula for the creation of the LGPD Crosswalk: LGPD

GDPR CROSSWALK

Example:
30

Was it ever used?

CASE STUDY

• Context: a Multinational organization that acquires small

companies to fuel their growth

• What they did: Used the Privacy Framework to develop

the preferable profile that a target should have and the

Crosswalks (GDPR and LGPD) to ensure compliance

• Benefits: They have gained an increased perception of

the real value of the targets and started to communicate

risk more effectively
31

What’s next?

Will we escape the Squid Game?

THANK YOU!

• Data privacy will continue to stay top of mind in Brazil

• LGPD will continue to evolve and be implemented

by ANPD’s regulations to come

• The Privacy Framework and the LGPD Crosswalk,

which are living documents, can help us go beyond

compliance
32

Resources

Website 

https://www.nist.gov/privacyframework

Mailing List 

List.nist.gov/privacyframework 

Contact Us 

PrivacyFramework@nist.gov 

@NISTcyber #PrivacyFramework