# PT-04 Consent

NIST SP 800-53 control. Family: PT Personally Identifiable Information Processing and Transparency. Function: preventative. Baselines: privacy. Mapping licence: CC BY-SA 4.0.

Statement: Implement [Assignment: organization-defined tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
Guidance: Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.

## Enhancements (3)
- PT-04(01) Tailored Consent
- PT-04(02) Just-in-time Consent
- PT-04(03) Revocation
Each enhancement's statement: /api/v1/controls/PT-04?fields=enhancements

## Patterns that use it (3)
- Critical (2): SP-039 Client-Side Encryption and Data Privacy; SP-045 AI Governance and Responsible AI
- Important (1): SP-050 Mobile Security Architecture (draft)

## Clauses by framework (30 frameworks)
- iso_27001_2022: A.5.34. OSA's own, not in NIST's crosswalk: A.5.34
- iso_27002_2022: 5.34
- cobit_2019: APO14
- cis_controls_v8: CIS 3
- iso_42001_2023: A.7.3
- bsi_grundschutz: CON.2
- anssi: SecNumCloud.19.3
- finma_circular: IV.D(78)
- gdpr: Art.5(1)(a), Art.6(1)(a), Art.7(1), Art.7(2), Art.7(3), Art.8(1)
- bio2: 5.34
- rbi_csf: Annex1.15
- cbuae: CR-5
- cbe_csf: CTO-2
- popia: s5, s11, s34-35, s69
- sa_js2: JS2-8.2
- bot_cyber: Ch2.3, Ch9.2
- nydfs_500: 500.18
- sebi_cscrf: DATALOC
- common_criteria: CC Part 2 — FPR
- hitrust_csf: 06.b, 13.b, 13.e
- iso_27799: 16.3, 18.1, 18.2, H.4
- lloyds_ms: MS7.1, MS8.7
- naic_ds: 3, 6-b, 8
- nhs_dspt: NDG-1.3
- solvency_ii: Art.49(3), EIOPA-Cloud-GL9
- owasp_masvs_v2: MASVS-PRIVACY-3, MASVS-PRIVACY-4
- csa_ccm_v4: DSP-11
- csa_aicm: DSP-11, DSP-23
- mica: Art.62(9), Art.98(1)
- dpdpa: Act.4, Act.5(1), Act.6(1), Act.6(3), Act.6(4), Act.6(6), Act.6(7)-(9), Act.9(1), Rules.3, Rules.4, Rules.10, Rules.11
OSA's mapping for iso_27001_2022 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/PT-04
- Clauses only: /api/v1/controls/PT-04?fields=mappings
- Page for people: /controls/pt-04/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.