Build a privacy programme around the AICPA PMF with less manual work

The AICPA Privacy Management Framework (PMF) is a voluntary framework for building and assessing a privacy programme. Published in 2020, it replaced the Generally Accepted Privacy Principles (GAPP) and organises privacy obligations into nine components, from management and notice through to security, data quality and monitoring. Each component contains criteria and points of focus that describe what good privacy practice looks like for personal information across its lifecycle.

No. The PMF is voluntary and there are no fines for not following it. Organisations adopt it because it gives them a structured, law-neutral way to manage personal information and show customers, regulators and auditors that their privacy programme is well designed. Your legal obligations still come from the privacy laws that apply to you, such as UK GDPR, EU GDPR or US state privacy laws.

The nine PMF components are: Management; Agreement, notice and communication; Collection and creation; Use, retention and disposal; Access; Disclosure to third parties; Security for privacy; Data integrity and quality; and Monitoring and enforcement. Together they follow personal information from the policies that govern it, through collection, use and sharing, to retention, disposal and ongoing oversight of how well the programme works.

The PMF is the 2020 update of the Generally Accepted Privacy Principles. GAPP was built around ten privacy principles, while the PMF uses nine components with criteria and points of focus. The update reflected changes in privacy law, notably the GDPR, and aligned the framework more closely with the AICPA Trust Services Criteria, so organisations using GAPP should move to the PMF.

The PMF is a privacy programme framework, while SOC 2 is an attestation report and ISO 27001 is a certifiable information security standard. They overlap heavily in areas such as access control, encryption, incident response and vendor management. The PMF's Security for privacy component covers many of the same controls, so one set of well-evidenced controls can support all three.

The PMF was updated with the GDPR in mind, so its components on notice, consent, access, correction, retention, disclosure and breach notification line up closely with GDPR obligations. Following it gives you a practical structure for a GDPR or UK GDPR programme. It does not replace legal analysis, though: you still need to confirm your lawful bases, records and rights handling meet the law itself.

It depends on the maturity of your existing privacy and security programme. Organisations that already run ISO 27001 or SOC 2 controls usually have much of the Security for privacy component in place and can focus on notice, consent, data subject rights and retention. Starting from scratch takes longer, because you need to map personal information, write policies and set up processes for requests and disclosures.

Yes. OneClickComply supports the AICPA PMF today. Its criteria are mapped to your existing controls, so your evidence shows where you meet each PMF criterion. Evidence from your connected tools, AutoComplete policies and vendor risk records counts towards the PMF alongside frameworks such as SOC 2, ISO 27001 and GDPR, and our in-house audit team can answer questions through Ask an Auditor.