The ability of information and communication technology to gather, process, and distribute vast amounts of information has magnified privacy concerns. Information privacy laws regulate the handling of personal identifiable information (PII) by recognizing the rights that persons should have and the responsibilities organizations should accept. This paper proposes a conceptual foundation for drafting such laws that takes into consideration the unique features of information, and it include definitions for identification of generic phases of handling of PII. The results are applied to the US Gramm-Leach-Bliley Act as a study case for building a basic framework for drafting of legal texts in the context of information privacy.