## 4 Overview of the Privacy-Protection Regulations and Frameworks
### The NIST and Five Safes Privacy Framework  
The industrial privacy frameworks have provided guidance for organisations to help them with data privacy and ensure the protection of individuals' personal data. This guidance involves standards, practices, and policies to follow to protect data, but mostly, the guideline's objectives are enhancing the protection level. These scopes are broad, including various approaches such as data collection, processing, storage, and sharing. The guidelines are designed to be applied to a wide range of organisations, such as non-profit organisations, businesses, or governmental organisations. This study focuses on the NIST and Five Safes privacy frameworks due to the limited existing literature analysing their principles, particularly in privacy risk-mitigation scenarios. The NIST framework is a recent addition to its security counterpart. The widely used but older Five Safes framework, notably implemented by entities like the Australian Bureau of Statistics (ABS), presents a unique opportunity for exploration. While other frameworks, such as International Organisation for Standardisation/International Electrotechnical Commission (ISO/IEC) 27701 and privacy by design [46], have been extensively studied, our analysis seeks to fill the research gap between these two frameworks, providing new insights into their effectiveness and application. Privacy frameworks have brought significant change within organisations and other entities, shaping their approach to data privacy and protection techniques, which includes enhancing transparency, increasing individuals' privacy rights, and mitigating privacy risks. One of the significant changes that influenced organisations was the transparency of their data processing with their users, which ultimately forced them to be compliant with privacy regulations. These include guidelines and practices to inform individuals properly and clearly about how their data will be used and shared. Additionally, these privacy frameworks have helped organisations comply with privacy regulations by implementing mechanisms and practices to be cautious when sharing information with third-party organisations or securing personal data in a manner that minimises privacy disclosure. In the last couple of decades, many privacy frameworks have been developed to aid organisations with guidance and practices. One of these privacy frameworks is Five Safes, which was developed to help researchers, particularly in academics. However, with its wide recognition, it is also used in businesses and governmental organisations such as ABS [47]. The main objective of the Five Safes is to create a structured approach for these organisations for better data accessibility and useability whilst minimising privacy risks. The key five dimensions of the framework are (1) people, (2) projects, (3) settings, (4) data, and (5) outputs. These independent questions are used to conduct a risk assessment scheme for data accessibility and data. In recent years, another privacy framework was developed by the National Institute of Standards and Technology (NIST), called the NIST privacy framework, designed to manage and protect individuals' privacy. Although this framework was developed very recently, it is believed to be widely used across many organisations and businesses of various sizes. This framework provides guidelines and standards for organisations to adopt to their privacy practices or procedures [48]. The scope of this framework covers a wide range of privacy concerns, including identification, governance and controlling privacy risks. The key main functions of the privacy framework are (1) identify, (2) govern, (3) control, (4) communicate, and (5) protect. Both the NIST and Five Safes privacy frameworks are designed to provide voluntary guidelines and risk assessments to mitigate privacy risks. However, there are slight differences when considering the use cases of data collection, processing, and sharing.