.png)
What Is The DPMP?
The Data Privacy Management Principles (DPMP) are a single set of data privacy principles. Each principle is linked to the Secure Controls Framework (SCF) controls that implement it and to the privacy laws and frameworks those controls map to.
The SCF team selected over a dozen of the most common privacy frameworks and created a set of simplified, yet comprehensive, privacy management principles. The work was a volunteer effort in support of the Secure, Compliant & Resilient (SCR) initiative.
Included As A Tab In The SCF Download
The DPMP is not a separate document. It is the tab named Data Privacy Mgmt Principles in the SCF Excel download, which holds every principle, its linked SCF controls and their framework mappings. The same download includes the full SCF control catalog and its Secure, Compliant & Resilient Capability Maturity Model (SCR-CMM) maturity criteria.
Who Is The DPMP For?
The DPMP helps cybersecurity and privacy professionals who have to choose a set of privacy principles for an organization and must reconcile privacy frameworks that do not line up, the "apples to oranges" problem.
Organizations With Multiple Privacy Requirements
The DPMP brings a common language to organizations that have to address multiple privacy requirements.
Teams Using The SCF
Because the principles are mapped to SCF controls, organizations can use the SCF for both their cybersecurity and privacy needs.
How Is The DPMP Organized?
The DPMP has three layers: 11 domains, the numbered principles within each domain and the SCF controls linked to each principle, one control per row. Each row also shows where its linked control maps in each privacy law or framework, with one column per law or framework.
How Do Organizations Use The DPMP?
Organizations use the DPMP in a Plan, Do, Check, Act (PDCA) cycle that advances their data privacy management practices over time.
Identify Privacy Obligations
The organization lists the privacy laws, regulations and frameworks that apply to it based on where it operates and its industry, then finds each one among the tab's framework columns.
Select The Applicable Principles
The tab is narrowed to those framework columns to show the principles and linked controls they map to. The organization then decides which principles apply based on its jurisdictional and industry requirements.
Set Privacy Targets
Privacy targets are defined for the 11 domains. The main control tab gives maturity criteria for each linked control, from Level 0, Not Performed, to Level 5, Continuously Improving.
Implement Through The Linked Controls
Each applicable principle is implemented through its linked SCF controls, and implementation evidence is documented. The main control tab gives each control's control question, possible solutions by business size, evidence request item and validation cadence.
Check And Improve
Control effectiveness is assessed against the maturity targets, compliance is reviewed against the mapped frameworks and gaps are identified across all 11 domains. Controls and procedures are then updated, maturity advances over time and lessons learned feed the privacy program roadmap.
Every principle, linked control and framework mapping is in the Data Privacy Mgmt Principles tab of the SCF workbook.
87 Principles Across 11 Privacy Domains
The DPMP groups its principles into 11 domains, from Data Privacy by Design through Business Environment. Each domain opens with a domain-level principle of its own, followed by its numbered principles.
Privacy Domain 1
Data Privacy by Design
Principles for a data privacy program that addresses privacy by design in policies, standards, processes, systems, applications, projects and third-party contracts.
Privacy Domain 2
Data Subject Participation
Principles for involving data subjects in decisions about the processing of their personal data, including consent and the right to opt out.
Privacy Domain 3
Limited Collection & Use
Principles that limit the collection of personal data to what is necessary for a legally authorized purpose and restrict its internal use to authorized purposes.
Privacy Domain 4
Transparency
Principles for clear and conspicuous public notice of data privacy practices, including the specific purposes for which personal data is collected and used.
Privacy Domain 5
Data Lifecycle Management
Principles for managing personal data across its lifecycle, from collection and processing through retention and secure destruction.
Privacy Domain 6
Data Subject Rights
Principles that give data subjects access to their personal data and the opportunity to correct it, seek redress, appeal and request its deletion.
Privacy Domain 7
Secure by Design
Principles for administrative, technical and physical safeguards that protect sensitive and regulated data in proportion to the risk of unauthorized access, use, modification, loss or dissemination.
Privacy Domain 8
Incident Response
Principles for tested incident response plans and training, a coordinated response to incidents and notification of breaches involving personal data.
Privacy Domain 9
Risk Management
Principles for identifying, evaluating and responding to data privacy risks, including a risk register and Data Protection Impact Assessments (DPIAs).
Privacy Domain 10
Third-Party Management
Principles for data privacy oversight of third parties with access to personal data, including contract terms and validation of their data privacy controls.
Privacy Domain 11
Business Environment
Principles that set the organizational context for data privacy, including policies and procedures, periodic review, metrics and reporting to the governing body.
How The DPMP Integrates With The SCF
A DPMP principle is implemented through its linked SCF controls. The framework entries on each row of the tab are the linked control's own mappings, the same as on the main control tab, so a principle maps to a privacy law through the controls that implement it.
On the main control tab, the SCF DPMP 2026 column shows the principle or principles each linked control supports. The same row carries that control's SCR-CMM maturity criteria and its Evidence Request List (ERL) item.
Multi-Jurisdiction Compliance
Organizations subject to several privacy laws can see where those laws overlap. Principle 6.6, Right to Erasure, is linked to one control, PRI-40, and that one row shows the sections PRI-40 maps to in the EU General Data Protection Regulation (GDPR), the UK Data Protection Act (DPA), the California Consumer Privacy Act (CCPA) and other US state privacy laws.
DPMP Works With The SCF Ecosystem
The maturity criteria and evidence items for each linked control come from other free SCF content.
SCR-CMM: Capability Maturity Model
The SCR-CMM gives each linked control maturity criteria from Level 0, Not Performed, to Level 5, Continuously Improving, used to set and check privacy targets.
ERL: Evidence Request List
The ERL item on each linked control names the evidence to collect, with its full description on the Evidence Request List tab of the SCF workbook.
Mapped To 32 Privacy Frameworks
The framework columns of the Data Privacy Mgmt Principles tab are listed below, grouped by region as their headings are. A blank cell on a row means the linked control has no mapping in that column.
%20(white).png)