The National Institute of Standards and Technology (NIST) has released the initial public draft of Privacy Framework version 1.1 (PFW 1.1), the first major revision since the framework’s original release in 2020. The update is intended to better align with NIST’s recently revised Cybersecurity Framework (CSF 2.0) while addressing new privacy risks, particularly those stemming from emerging technologies such as artificial intelligence.
Version 1.1 retains the original framework’s five core privacy functions—Identify, Govern, Control, Communicate, and Protect—but introduces several structural and content updates. A key addition is a dedicated section addressing AI privacy risks, which reflects growing concern about how AI systems can introduce new avenues for privacy harm, such as inference attacks, bias amplification, and automated generation of invasive content.
The framework continues to be organized around three main components: the Core (a set of privacy protection activities and outcomes), Organizational Profiles (which help tailor the framework to an organization’s specific goals and environment), and Implementation Tiers (used to assess privacy risk management maturity and communication). These components collectively aim to help organizations of all sizes and sectors manage privacy risks in a technology-neutral and flexible manner.
NIST has launched a public comment period that runs through June 13, 2025. Stakeholders are encouraged to submit feedback via email to privacyframework@nist.gov, using a template available on the NIST website. In addition to input on implementation examples and the potential mapping of the NIST Privacy Workforce Taxonomy to the Core, NIST is also seeking feedback on whether to renumber subcategory identifiers and how to streamline the document for usability.
The draft also reflects a content shift: Section 3, which previously provided user guidance, has been moved to the Privacy Framework website to allow for more timely updates and interactive access. To support the rollout of PFW 1.1, NIST has launched an expanded set of online tools, including multilingual quick-start guides, an interactive FAQ, and a short video outlining key highlights of the update.
Stakeholder engagement remains a foundational element of NIST’s process. “As always, engagement with the production of these underlying frameworks can pay dividends for the establishment of benchmarks and best practices for the privacy profession,” said Cobun Zweifel-Keegan, Managing Director for the IAPP in Washington, D.C.
NIST is also encouraging organizations to apply the revised Privacy Framework in tandem with its AI Risk Management Framework (AI RMF), recognizing that privacy and AI risks are increasingly interconnected. While AI is a focal point of the new draft, the framework remains broadly applicable and designed to adapt to a range of emerging technologies.
The Privacy Framework is voluntary, sector-agnostic, and intended to help organizations of all sizes build privacy risk management programs aligned with their mission, values, and legal obligations. By updating the framework to better integrate with CSF 2.0 and incorporate contemporary concerns, NIST aims to maintain its relevance as a foundational tool for privacy governance.
Sources: IAPP, NIST, Security Boulevard, Tenable
—
April 24, 2025 – by Cass Kennedy
