Generally Accepted Privacy Principles (GAPP)

Why does it matter?

GAPP matters today as the ancestor of the AICPA's current privacy guidance and as the structure many privacy programs, control libraries and audit work papers in North America still follow. Reading it against the PMF shows what changed in 2020: choice and consent folded into agreement, notice and communication; collection extended to creation; quality renamed data integrity and quality. A team that knows where its GAPP criteria went can move a program to the PMF, or to the Trust Services privacy criteria used in SOC 2 reports, without rebuilding it.

Key benefits include:

• A complete map of a privacy program

Ten principles run from governance (Management) through the data lifecycle (Collection; Use, retention and disposal; Disclosure to third parties) to assurance (Monitoring and enforcement).

• Criteria written to be assessed

Each principle breaks into measurable criteria, which is why auditors and SOC practitioners adopted GAPP as a privacy assessment baseline.

• The 2009 additions still hold

Annual privacy risk assessment, incident and breach management, awareness and training and portable-media protection were added in the 2009 edition and remain in the PMF.

• A clean path to the successor

The PMF's nine components correspond to the ten GAPP principles, so a GAPP control library converts without losing coverage.

• Common language for assurance

Because the AICPA wrote both GAPP and the Trust Services Criteria, GAPP-trained teams read SOC 2 privacy criteria with little translation.

How does it work?

GAPP states one overall objective, that personal information is collected, used, retained, disclosed and disposed of in conformity with the commitments in the entity's privacy notice and with criteria set out in the principles, and supports it with ten principles. Management requires the entity to define, document, communicate and assign accountability for its privacy policies and procedures. Notice and Choice and consent cover what individuals are told and the implicit or explicit consent obtained. Collection limits data to the purposes identified in the notice.

Use, retention and disposal, Access, and Disclosure to third parties govern the rest of the lifecycle: use only for notified purposes, retention no longer than needed, individuals' access to their own information, and disclosure to third parties only with consent or as the notice allows. Security for privacy requires protection against unauthorized access, Quality requires accurate, complete and relevant information, and Monitoring and enforcement requires the entity to monitor compliance and to handle inquiries, complaints and disputes.

Practitioners assessed an organization against the criteria under each principle, recorded gaps and remediation, and used the result for internal reporting or for an attestation engagement. Since 2020 the same assessment is run against the PMF, which the AICPA makes available for download with a free account. GAPP itself is no longer distributed by the AICPA, which is why this page describes it as a historical edition and points to the PMF as the current document.

Key Elements

• Management

Accountability for privacy policies and procedures, including the annual privacy risk assessment (criterion 1.2.4), incident and breach management (1.2.7) and awareness and training (1.2.10) added in 2009.

• Notice, and Choice and consent

Notice of the purposes for collection, use, retention and disclosure, and the choices offered to individuals with the consent obtained.

• Collection, and Use, retention and disposal

Collection limited to notified purposes; use, retention and disposal governed by the same purposes.

• Access, and Disclosure to third parties

Individuals' access to review and update their information, and disclosure to third parties only as consented or notified.

• Security for privacy, and Quality

Protection of personal information against unauthorized access, including on portable media (criterion 8.2.6), and accurate, complete and relevant data.

• Monitoring and enforcement

Monitoring of compliance and procedures for inquiries, complaints and disputes.

What does it cover?

GAPP was written for any entity that collects, uses, retains, discloses or disposes of personal information, in any sector and country, and for the CPA and CA practitioners who assess those entities. It covered the full lifecycle of personal information under its ten principles. Its scope today is historical: the AICPA superseded it with the Privacy Management Framework in 2020, so GAPP applies only to programs and assessments that were built on it and have not yet moved to the PMF or to the Trust Services privacy criteria.

What are its objectives?

GAPP was written to give organizations and practitioners a single, assessable privacy framework.

Bring international privacy requirements and good practice together in one set of principles.

State each principle as criteria that an organization can implement and a practitioner can assess.

Hold management accountable for privacy policy, risk assessment, incidents and training.

Protect personal information across collection, use, retention, access, disclosure, security, quality and disposal.

Provide a basis for privacy assurance, now carried forward by the PMF and the Trust Services Criteria.

Framework in Context

GAPP sits in the AICPA's lineage of privacy guidance: it followed the 2006 edition, received its 2009 update after the March 2009 exposure draft, and was replaced in 2020 by the Privacy Management Framework because of changes in technology, privacy laws such as the GDPR and the Trust Services Criteria. The Trust Services Criteria, used in SOC 2 reports, treat privacy as one of five categories alongside security, availability, processing integrity and confidentiality. Organizations that need a current framework use the PMF, ISO/IEC 27701 or the NIST Privacy Framework, and map GAPP to them only to migrate legacy programs.

Common Framework Mappings

GAPP is mapped to its successor and to the frameworks that current privacy programs use, mostly to carry a legacy control library forward.

Mapped frameworks include:

AICPA Privacy Management Framework (2020)

SOC 2 (AICPA TSC 2017)

CCPA/CPRA

GDPR

ISO 27701

NIST Privacy Framework v1.0

SOC 2