Controlled Unclassified Information (CUI)

CUI Registry: Privacy


Category-Subcategory: Privacy
Category Description:

Refers to personal information, or, in some cases, "personally identifiable information," as defined in OMB M-17-12, or "means of identification" as defined in 18 USC 1028(d)(7).

Subcategory Description: N/A
Marking: PRVCY


  • CUI Specified authorities include specific handling practices that differ from general CUI requirements. For Specified authorities, reference individual Safeguarding/Dissemination control citations for distinct requirements
  • Whether CUI is Basic or Specified is determined by the applicable Safeguarding and/or Dissemination Authority for that CUI.
  • Each "Safeguarding and/or Dissemination Authority" citation links to the statute, regulation or government-wide policy authorizing the control of that information as CUI.
  • Each "Sanctions" authority links to the statute, regulation or government-wide policy that includes penalties for CUI misuse of CUI for the associated "Safeguarding and/or Dissemination Authority" on the same line.

Safeguarding and/or Dissemination Authority Basic or
5 USC 552a(b) Basic 5 USC 552a(i)
42 USC 16918(b)(2) Basic  
29 CFR 2400.4 Basic  
29 CFR 2705.9 Basic  
12 CFR 792.60 Basic  
12 CFR 792.69(c) Basic  
17 CFR 146.6(a) Basic  
18 CFR 3b.225(a) Basic  
5 CFR 297.401 Basic  
OMB M-17-12 Previously OMB M-07-16. Specified  
48 CFR 22.1024 Basic  
20 CFR 401.100 Basic  
20 CFR 401.105(b) Basic  
11 CFR 1.14 Basic  
OMB Circular A-130 Basic  



Authority links are updated based on regular re-publication of the United States Code and Code of Federal Regulations, and the CUI Registry maintenance schedule.