Put the FIPPs into practice with privacy controls you can evidence

The FIPPs are a set of widely accepted principles for handling personally identifiable information responsibly. OMB Circular A-130 lists nine: Access and Amendment, Accountability, Authority, Minimization, Quality and Integrity, Individual Participation, Purpose Specification and Use Limitation, Security, and Transparency. US federal agencies use them when evaluating information systems, processes and programmes that affect individual privacy.

No, the FIPPs are not themselves a law. OMB Circular A-130 states that they are principles rather than OMB requirements, applied by each agency according to its mission and privacy programme. However, they underpin binding laws such as the Privacy Act of 1974, and agencies are required to manage PII under A-130, so contractors may be held to FIPPs-aligned obligations through their contracts.

The FIPPs are rooted in a 1973 report by the US Department of Health, Education, and Welfare Advisory Committee, titled "Records, Computers and the Rights of Citizens". Since then they have informed US federal statute, the laws of many states and other countries, and the policies of organisations worldwide. The current US federal expression is in Appendix II of OMB Circular A-130, revised in 2016.

US federal agencies are expected to apply the FIPPs across their privacy programmes, and contractors that handle agency PII are often asked to demonstrate alignment. Beyond government, many private organisations voluntarily adopt the FIPPs as a foundation for their privacy programme, because the principles are reflected in most modern privacy laws and give a consistent baseline across jurisdictions.

The FIPPs and GDPR share the same roots and cover similar ground. GDPR's principles of transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability closely mirror the FIPPs, and GDPR's data subject rights cover access and correction. GDPR is binding law with fines, while the FIPPs are principles, so an organisation that complies with GDPR will usually satisfy much of the FIPPs.

NIST SP 800-53 turns privacy principles like the FIPPs into specific controls for federal systems. OMB Circular A-130 notes that its Access and Amendment principle sits within the Individual Participation privacy control family in an earlier revision of SP 800-53. In practice, agencies use the FIPPs as the principles and NIST SP 800-53 privacy controls as the way to implement and assess them.

You implement the FIPPs by translating each principle into concrete controls and evidence. Typical steps are documenting your legal authority and purposes, publishing clear privacy notices, limiting collection and retention, handling access and correction requests, keeping data accurate, applying proportionate security safeguards, and assigning accountability with training, monitoring and audit. Privacy impact assessments help show the principles were considered for each system.

Yes, on request. The FIPPs are mapped in OneClickComply's control library and available on request, rather than live as a ready-made framework today. Once enabled, each principle links to controls you may already run for GDPR, ISO 27001 or SOC 2, so evidence collected once counts towards the FIPPs too. OneClickComply does not certify FIPPs compliance, as no formal certification exists.