Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

Katie MacFarland

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000

Gaithersburg, MD 20899

PrivacyFramework@NIST.gov

14 January, 2019

Re: Developing a Privacy Framework (Docket No. 181101997-8997-01) 

Dear Ms. MacFarland,

Nymity appreciates the opportunity to comment on the National Institute of Standards and Technology’s 

(“NIST”) recent request for information regarding the development of a privacy framework. Our comments seek 

to provide insight into how organizations around the world are currently managing enterprise wide privacy risk 

through the use of an existing, and widely-adopted, operational, outcome-focused privacy management 

accountability framework. Our comments will discuss the following:

• Part 1: The Nymity Privacy Management Accountability FrameworkTM (“Nymity Framework”) for 

Identifying and Mitigating Risk

• Part 2: Nymity Processing Purposs Risk FrameworkTM

About Nymity 

Nymity is a privacy research company providing research-based privacy management and compliance solutions 

to support the privacy office. For over 17 years, Nymity has helped thousands of privacy officers worldwide 

operationalize privacy management accountability and compliance and has helped organizations demonstrate 

compliance with 100’s of privacy laws, frameworks, guidelines and regulations. 

The area of “demonstrable privacy compliance and accountability” is one in which Nymity has done extensive 

research on both the concept and the implementation. In fact, Nymity has been conducting research since the 

notion of demonstrating accountability to a supervisory authority was first introduced in the 2009 Madrid 

Resolution1. In 2012 Nymity released the Nymity Privacy Management Accountability FrameworkTM2 and since 

that time, a host of other thought leadership around privacy management accountability and compliance which 

has been made available for free to the privacy community.3

 

1 https://icdppc.org/wp-content/uploads/2015/02/The-Madrid-Resolution.pdf

2 https://www.nymity.com/data-privacy-resources/privacy-management-framework.aspx 

3 https://info.nymity.com/resources
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

Part 1: The Nymity Privacy Management Accountability FrameworkTM (“Nymity Framework”) for 

Identifying and Mitigating Risk

Organizations around the world are operationalizing global privacy compliance and managing privacy risk 

through the Nymity FrameworkTM tool and effectively bridging the gap between and policies and principles and 

the implementation of practical and effective privacy management. 

This image above is a thumbnail view of the Nymity Privacy Management Accountability Framework which is 

attached as Appendix A. 

a. How was the Framework developed? 

In 2002, Nymity began its research on accountability and building compliance solutions for individuals 

responsible for privacy within organizations. In 2009 Nymity enhanced this research through on-the-ground 

workshops around the world, including privacy and data protection regulators, examining what it would take for 

organizations to “demonstrate” accountability (e.g. internally to management or a board or externally to a 

regulator). Nymity’s research revealed that no matter the industry or jurisdiction, privacy officers and other 

privacy leaders in organizations conduct many of the same activities. This led to the development of the Nymity 

Framework which was first released in 2012. It is made up of 13 Privacy Management Categories each 

containing multiple Privacy Management Activities (or technical and organisational measures), over 130 in total. 

It is a comprehensive, jurisdiction- and industry-neutral and works with privacy programs that are relatively 

new or very mature.
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

It was originally developed for communicating the status of the privacy program, in other words a framework 

for demonstrating accountability. It was designed to report on any privacy program, no matter how it is 

structured. For example, it works well with privacy programs structured around privacy principles, rationalized 

rules, standards and codes. 1000’s of organizations around the world are using the framework to structure 

their privacy programs. 

In 2015, the Nymity Framework was further enhanced with supporting tools after additional on the ground 

research with over 500 privacy officers across 20 countries and over 50 cities. It has been made available to the 

global privacy community for free and has become a recognized framework used for a variety of purposes. In 

fact, the Framework has been recognized as an international standard and is being taught as such at the 

Singapore Management University in an Advanced Certificate Program on Data Protection Frameworks and 

Standards.4

b. Privacy Management Activities are Supported by “Scopes” 

Each of the 130+ privacy management activities are supported by a “scope” description to assist privacy officers 

in implementing and maintaining the activity. Example scopes are shown below and the entire scopes 

document is available for free through Nymity’s resources.5

 

4 https://academy.smu.edu.sg/index.php/data-protection-framework-and-standards-iso-29100-nymity-accountability-and-apec-privacyframework

5 Available at https://info.nymity.com/privacy-management-accountability-framework.
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

 

 

c. Is the Framework a “checklist” of privacy management requirements? 

No. The Framework is not a one-size-fits-all approach and should not be implemented as such. It may be 

considered a “menu”, not a checklist. Different sectors and individual organizations have different situations, 

needs and risk profiles and customize use of the Framework according to their unique needs and risks. 

d. One Framework: Multiple Purposes 

Although originally designed as a framework for demonstrating accountability, organizations around the world 

are using the Framework for multiple other purposes including: 

• Structuring the privacy program: Some organizations, often those with a new privacy program or 

enhancing their existing program, have found the Nymity Framework effective for structuring the 

privacy program. The may use all 13 Privacy Management Categories or a subset. For example, a 

North American service provider/data processor many not implement many of the activities within 

certain Privacy Management Categories as they are not relevant given the nature of their data 

processing activities.

• Baselining and planning: Some organizations use the Nymity Framework as a checklist to identify 

existing Privacy Management Activities and for planning the implementation of new ones.

• Benchmarking: The Nymity Framework provides an effective mechanism to compare the privacy 

program across different areas of the organization, or between two organizations.

• Regulatory Reporting: Reporting to a regulator is a form of demonstrating accountability. Some 

organizations are using the Nymity Framework to show due diligence, for example in the event of a 

data breach to demonstrate that the event was an exception that occurred despite a robust 

program in place to prevent it, as opposed to a systemic issue.

• Shifting Privacy Accountability to the Business: Many privacy officers see the need to shift 

accountability to the business which in turn will allow the organization to cover more risk and 

incorporate privacy by design throughout the organization. The Nymity Framework is used as a 

structure to ensure the creation and maintenance of “accountability mechanisms” which ultimately 

empower the business, and ongoing compliance and monitoring of the program. Using the 

foundation of existing global policies and guidelines that address regulatory requirements, the 

Nymity Framework is used as a tool to make sure there are procedures, work instructions and 

guidelines that could be leveraged more globally and in a more scalable, regulatory agnostic and 

efficient way for the organization. 

6

 

 

6 As discussed in Nymity’s Publication, “From Privacy Project to Privacy Program: Leveraging GDPR Compliance Initiatives to Create One 

Accountable Privacy Program in Order to Comply with Multiple Laws” found at https://info.nymity.com/from-privacy-project-to-privacyprogram-whitepaper. Co-authored by Jennie Hargrove, HID Global, Michael Scuvee, Coca-Cola European Partners and Alexys Carlton, 

Otter Products and Blue Ocean Enterprises.
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

• Converting One-Time Compliance Projects into Sustainable Business Operations: Considering the 

European GDPR7compliance efforts as an example, in practice, many companies organized their 

GDPR project into work packages in order to implement the requirements (whether it is in strategy, 

assigning responsibilities for the new controls, creating records of processing activities or revisiting 

notices, policies and procedures). The adoption of the Nymity Framework makes it easy to identify a 

stable and natural home for the controls resulting from work packages and deliverables of a GDPR 

project.8

• Prioritizing Investments and Justifying Budgets: The Nymity Framework helps organizations 

determine which privacy management activities are most important to assure risk management, 

privacy compliance and accountability. In turn, this helps organizations justify the prioritization on 

investments and maximize resources

• Communicating Privacy and Risk: The Nymity Framework provides a common language for privacy 

management within the organization. This improves understanding among various departments 

including in IT, operational and functional units such as IT, HR and marketing. It also serves in 

reporting the status of the privacy program to the Board and other key stakeholders .

• Auditing and Assessing: The Nymity Framework is also used by organizations to audit and assess 

privacy management throughout the organization. 

e. Nymity Framework Mapping to Comply with Multiple Laws, Frameworks and Other 

Privacy Obligations 

The Nymity Framework has been mapped to over 800 privacy laws, international privacy frameworks, guidelines and 

regulations from around the world and serves as one framework resulting in compliance with multiple obligations.

Below is a thumbnail view of a selection of obligation requirements that have been mapped the Nymity 

Framework and this selection is available in its entirety in Appendix B.

Mapping a multitude of privacy obligations to the Nymity Framework has been invaluable to organizations in 

bridging the gap between policies and procedures and one accountable, efficient, scalable and repeatable 

privacy management program.

 

7 Regulation EU 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the 

processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection 

Regulation).

8 As discussed in Nymity’s Publication, “From Privacy Project to Privacy Program: Leveraging GDPR Compliance Initiatives to Create One 

Accountable Privacy Program in Order to Comply with Multiple Laws” found at https://info.nymity.com/from-privacy-project-to-privacyprogram-whitepaper. Co-authored by Jennie Hargrove, HID Global, Michael Scuvee, Coca-Cola European Partners and Alexys Carlton, 

Otter Products and Blue Ocean Enterprises.
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

Part 2: Nymity Processing Purposes Risk FrameworkTM 

The GDPR is considered a risk-based regulation. This means, in part, that organizations must take extra steps to 

identify likely high risk processing prior to the processing and conduct a risk assessment. Article 35 (Data 

protection impact assessments) of the GDPR states that:

(1) where a type of processing in particular using new technologies, and taking into account the nature, 

scope, context and purposes of the processing, is likely to result in a high risk to the rights and 

freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of 

the impact of the envisaged processing operations on the protection of personal data.9

In connection with this requirement, and to support organizations in identifying high-risk, Nymity conducted 

extensive research in order to help companies in identifying likely high risk. One of the main measures of high 

risk relates to the purposes of processing personal data. Nymity’s research identified a comprehensive list of 

purposes of processing that has been categorized in order to create a processing purposes risk Framework. The 

Framework is included here. 

 

9 Article 35(1) Regulation EU 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to 

the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection 

Regulation).
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 
Nymity Inc. • 360 Bay Street, 6th Floor, Toronto, ON, Canada • M5H2V6 • T: +1 647 260 6230 

Concluding Comments 

Nymity appreciates the opportunity to provide comments for this initiative and appreciate NIST’s engagement 

with the global privacy community. We look forward to continuing to work with your office throughout this 

process.

Terry McQuay

President and Founder

Nymity, Inc.

Teresa Troester-Falk

Chief Global Privacy Strategist,

Nymity, Inc.