In a privacy management environment, a logical statement that identifies how personally identifiable information (PII) can be used. A statement identifies PII types, the groups that can access the PII types, the purposes for which the PII types can be used, and conditions that might apply to the use of the PII. For example, a privacy policy might include the following usage statement: "Doctors (group) can access medical records (PII type) for diagnosis and treatment (purpose)." See also condition rule.