The 10 Generally Accepted Privacy Principles, known as GAPP, are a framework published by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA) that organizes privacy management into ten areas: management, notice, choice and consent, collection, use and retention and disposal, access, disclosure to third parties, security for privacy, quality, and monitoring and enforcement. Each principle is supported by measurable criteria (73 in total) that auditors and organizations use to evaluate how personal information is handled from collection through destruction.1AICPA. Privacy Management Framework
The 10 Principles at a Glance
Each principle covers a different stage or dimension of privacy management. Together they trace the full lifecycle of personal information.
- Management. Define, document, and assign accountability for privacy policies.
- Notice. Tell individuals why you collect their data and what you do with it.
- Choice and consent. Give people meaningful options about how their information is used.
- Collection. Gather only the personal information you actually need for the stated purpose.
- Use, retention, and disposal. Limit data use to disclosed purposes, keep it only as long as necessary, and destroy it properly afterward.
- Access. Let individuals review and correct the personal information you hold about them.
- Disclosure to third parties. Share data only for purposes the individual consented to, and only with parties that can protect it.
- Security for privacy. Protect personal information against unauthorized access, both physical and digital.
- Quality. Keep records accurate, complete, and relevant.
- Monitoring and enforcement. Audit your own compliance and handle privacy complaints.
The 73 supporting criteria turn broad ideas like “provide notice” into concrete questions an auditor can test: Does the privacy notice identify every category of data collected? Does it name every third party that receives that data? That specificity is what makes GAPP useful for compliance work rather than aspirational policy drafting.
A Note on the 2020 Rename
In 2020, the AICPA updated GAPP and renamed it the Privacy Management Framework (PMF). The revision was driven by shifts in global privacy law, particularly the EU’s General Data Protection Regulation, and by updates to the AICPA’s Trust Services Criteria. The biggest structural change was reworking the choice-and-consent principle: instead of separate opt-in and opt-out mechanisms, the PMF now uses a transaction-based model in which consent is embedded in the business transaction and governed by applicable law.1AICPA. Privacy Management Framework The other nine principles carried forward with updated language.
References to “GAPP” in audit reports and vendor questionnaires today almost always mean the underlying 10 principles as updated in the PMF. The concepts are largely intact; the packaging has changed.
Management and Notice
Privacy governance starts with someone being accountable. The management principle requires an organization to designate specific people responsible for privacy policies, communicate those policies internally, and keep them current as regulations change. In practice, that often means appointing a privacy officer or a small team reporting to senior leadership. Under the GDPR, the obligation is legally mandatory in some cases: public authorities must appoint a Data Protection Officer, and private organizations must do the same if their core activities involve large-scale processing of sensitive data or systematic monitoring of individuals.2European Commission. Does My Company/Organisation Need to Have a Data Protection Officer (DPO)? Without a named owner, privacy policies tend to drift into irrelevance.
The notice principle requires telling individuals what data you collect, why you collect it, and who receives it before collection begins. A good privacy notice identifies each category of personal information gathered, the specific business purpose behind each category, and the retention period. Vague language like “we may share your data with partners for business purposes” fails the principle. The notice needs enough detail that a reader could predict, in broad terms, what will happen to their information.
Choice, Consent, and Collection
Under the original GAPP framework, choice and consent distinguishes between sensitive and non-sensitive data. Sensitive categories like health records, financial history, and children’s information typically call for opt-in consent, meaning the organization cannot use the data for secondary purposes unless the individual actively agrees. Less sensitive data may rely on opt-out mechanisms, where the individual can decline secondary uses but doesn’t need to affirmatively approve them. The distinction matters most for marketing, behavioral analytics, and data sharing with affiliates.
Collection is governed by a straightforward rule: gather only what you need for the purposes stated in your notice. An e-commerce site needs a shipping address and payment method. It probably doesn’t need a date of birth or employment history. Overcollection creates risk with no corresponding benefit, and regulators now scrutinize whether collection practices match the scope of the disclosed purpose.
Use, Retention, and Disposal
Once collected, personal information must stay within the lanes described in the original notice. An organization that gathers email addresses for shipping notifications cannot later feed them into a marketing campaign without going back to the individual for consent. Internal controls like access restrictions and use logging help prevent data from being quietly repurposed by other departments.
Retention schedules depend on the type of data and the legal obligations attached to it. The IRS requires taxpayers to keep records for at least three years from the filing date, extending to seven years for claims involving bad debts or worthless securities.3Internal Revenue Service. How Long Should I Keep Records? The SEC requires auditors to retain records relevant to audits and reviews for seven years after the conclusion of the engagement.4U.S. Securities and Exchange Commission. Retention of Records Relevant to Audits and Reviews Outside specific legal mandates, the underlying rule is simple: once the business purpose for holding data expires, the risk of keeping it outweighs the value.
Disposal Standards
Disposal is the step organizations most often get wrong. Deleting a file from a desktop or reformatting a drive does not actually remove the underlying data. The federal government’s benchmark for proper media sanitization is NIST Special Publication 800-88 Revision 1, which defines three levels of data destruction:5National Institute of Standards and Technology. NIST Special Publication 800-88 Revision 1 – Guidelines for Media Sanitization
- Clear. Overwriting data using standard read/write commands. Effective against casual recovery but does not address hidden storage areas on a drive.
- Purge. Applying physical or logical techniques that make data recovery infeasible even with laboratory equipment. Firmware-based secure erase commands fall into this category.
- Destroy. Physically rendering the storage media unusable through shredding, incineration, or pulverization.
The right method depends on sensitivity. Customer browsing data might warrant a Clear-level wipe, while protected health information or financial records typically require Purge or Destroy. For paper records, cross-cut shredding is the standard.
Access and Quality
The access principle gives individuals the right to review the personal information an organization holds about them and to request corrections when something is wrong.6AICPA & CIMA. Privacy Management Framework This is more than a courtesy. Inaccurate data can lead to denied credit applications, incorrect medical treatment, or wrongful fraud flags. When someone identifies an error, the organization needs a clear process for verifying the claim, updating the record, and confirming the correction back to the individual. Slow or opaque correction processes are a common source of regulatory complaints.
Quality reinforces access from the organization’s side. Validation checks at the point of entry, periodic reviews of stored records, and automated flags for outdated information all reduce the chance of decisions being made on bad data. That matters especially in automated systems, where a stale address or misspelled name can cascade through downstream processes without anyone noticing until the individual complains.
Third-Party Disclosure and Security
Sharing personal information with vendors, partners, or service providers is where many privacy programs break down. The disclosure principle requires that third-party transfers match the purposes described in the original notice and that the receiving party provides protections at least equivalent to the disclosing organization’s own standards. In practice, that means contractual obligations specifying how the data may be used, what security measures are required, and what happens if the third party experiences a breach.
The security-for-privacy principle covers the technical and administrative safeguards that prevent unauthorized access. Encryption is the foundational layer. Federal agencies and their contractors must use cryptographic modules validated under FIPS 140-3, which defines four escalating levels of security covering everything from software design to physical tamper resistance.7National Institute of Standards and Technology. FIPS 140-3 – Security Requirements for Cryptographic Modules Private organizations aren’t legally required to follow FIPS 140-3 in most cases, but using FIPS-validated encryption is a strong signal to auditors that security controls meet a recognized benchmark. Layered on top of encryption, access controls like multi-factor authentication and network defenses like firewalls and intrusion detection systems round out the defensive posture. These tools require regular updates; a firewall running rules from two years ago provides a false sense of protection.
Monitoring and Enforcement
The final principle closes the loop. Organizations must actively monitor whether their own practices match their stated policies rather than writing policies and hoping for the best. Internal audits, automated compliance checks, and periodic independent reviews help catch gaps before they become incidents. Equally important is a clear complaint process that individuals can actually find and use. Documenting how each complaint was received, investigated, and resolved builds a record that demonstrates accountability if regulators ask questions later.
Enforcement within the workforce matters just as much as external-facing compliance. Training employees on data handling, disciplining violations consistently, and building privacy awareness into onboarding all reinforce that these policies carry real consequences. Organizations that treat privacy rules as suggestions from the legal department tend to discover the hard way that regulators and courts treat them as obligations.
Where You’ll See These Principles Applied
GAPP’s most visible practical application is the SOC 2 examination. SOC 2 reports evaluate an organization’s controls across five trust services categories: security, availability, processing integrity, confidentiality, and privacy. Privacy is where the 10 principles (now updated in the PMF) supply the criteria auditors test against.
The principles also map closely to modern privacy laws. Roughly 20 U.S. states have enacted comprehensive consumer privacy laws, and the common threads across them mirror GAPP directly: notice requirements, purpose limitation, data minimization, individual access and correction rights, and obligations around third-party sharing. The GDPR aligns similarly on notice, consent, collection limitation, and security, though it goes further on data subject rights like portability and erasure and on mandatory Data Protection Officer requirements.2European Commission. Does My Company/Organisation Need to Have a Data Protection Officer (DPO)? Organizations already following GAPP will find much of the operational infrastructure needed for statutory compliance is already in place; the gaps tend to appear in newer concepts like the right to opt out of automated decision-making, which GAPP addresses only in general terms.