ISO 27701:2025

Requirements and controls

• Clauses Management system clauses

  • 4 Organizational context

    • 4.1 Organizational context for privacy

      Identify the internal and external factors that shape what the PIMS must achieve, including applicable privacy laws and whether the organization acts as a PII controller, a processor or both.

      • ISMS Manual
      • Data Governance
      • Personal Data Inventory

    • 4.2 Interested parties and their privacy needs

      Identify the stakeholders that matter to the PIMS, such as customers, individuals and regulators, and the privacy requirements it will address for them.

      • Data Governance
      • Contractual Obligations Register
      • ISMS Manual

    • 4.3 Scope of the PIMS

      Decide and document which PII processing, business units, locations and systems the PIMS covers.

      • ISMS Scope Document
      • Personal Data Inventory

    • 4.4 Running the PIMS

      Establish, operate, maintain and keep improving the privacy information management system and its processes.

      • ISMS Manual
      • Data Protection Policy & Procedure
      • Privacy Officer

  • 5 Leadership and direction

    • 5.1 Leadership commitment

      Top management backs the PIMS by setting direction, providing resources and building privacy into business processes.

      • Security & Privacy Program Review
      • Assigned Security & Privacy Responsibilities
      • Privacy Officer
      • ISMS Manual

    • 5.2 Setting the privacy policy

      Top management approves a privacy policy that fits the organization's purpose, frames its privacy objectives and commits to meeting requirements and improving.

      • Data Protection Policy & Procedure
      • Information Security & Privacy Policies
      • Privacy by Design Policy

    • 5.3 Privacy roles and authorities

      Privacy responsibilities and authorities are assigned and communicated, including a person accountable for PII protection.

      • Privacy Officer
      • Assigned Security & Privacy Responsibilities
      • Roles & Responsibilities
      • Compliance Program Manager

  • 6 Planning the management system

    • 6.1.1 Planning for risks and opportunities

      Plan how the PIMS will deal with the risks and opportunities that could affect its intended outcomes.

      • Risk Framing
      • Risk Assessment Policy & Procedure
      • ISMS Manual

    • 6.1.2 Privacy risk assessment method

      Define and apply a repeatable way to identify, analyze and evaluate privacy risks, including risks to the individuals whose PII is processed.

      • Risk Assessment
      • Data Protection Impact Assessments
      • Risk Framing
      • Risk Assessment Policy & Procedure

    • 6.1.3 Privacy risk treatment and applicability

      Choose how each privacy risk is treated, select the Annex A controls that are needed, and justify inclusions and exclusions in a statement of applicability.

      • Risk Assessment
      • Data Protection Impact Assessments
      • Management Review of Risks
      • ISMS Manual

    • 6.2 Privacy objectives

      Set measurable privacy objectives and plan who will achieve them, how and by when.

      • Security & Privacy Program Review
      • ISMS Manual
      • Data Protection Policy & Procedure

    • 6.3 Planning changes to the PIMS

      Make changes to the PIMS in a planned and controlled way.

      • ISMS Manual
      • Data Protection Impact Assessments
      • Privacy by Design Policy

  • 7 Resources and support

    • 7.1 Providing resources

      Provide the people, budget and tools the PIMS needs.

      • Security & Privacy Program Review
      • Privacy Officer
      • ISMS Manual

    • 7.2 Competent personnel

      Make sure the people whose work affects privacy are competent, and keep evidence of it.

      • Competency Screening
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training
      • Performance Review

    • 7.3 Staff awareness

      Make staff aware of the privacy policy, their part in the PIMS and what happens if they do not follow it.

      • Security & Privacy Awareness
      • Periodic Policy Acknowledgement
      • Periodic Security & Privacy Training

    • 7.4 Internal and external communication

      Decide what to communicate about privacy, when, to whom and how, inside and outside the organization.

      • Published Privacy Policy
      • Publishing Security & Privacy Documentation
      • Incident Reporting Assistance
      • Conspicuous Privacy Notice Link

    • 7.5.1 Required documentation

      Keep the documents and records the PIMS requires, plus any the organization judges necessary.

      • ISMS Manual
      • Information Security & Privacy Policies

    • 7.5.2 Creating and updating documents

      Give each PIMS document clear identification and a suitable format, and review and approve it before use.

      • Information Security & Privacy Policies
      • Management Review of Policies

    • 7.5.3 Controlling documents

      Protect, distribute, retain and dispose of PIMS documents in a controlled way.

      • Information Security & Privacy Policies
      • Policy Documentation Retention

  • 8 Operating the management system

    • 8.1 Planning and controlling operations

      Plan and control the processes needed to meet privacy requirements and to carry out the actions decided in planning.

      • ISMS Manual
      • Privacy by Design Policy
      • Personal Data Inventory

    • 8.2 Carrying out privacy risk assessments

      Perform privacy risk assessments at planned intervals and whenever significant changes occur, and keep the results.

      • Risk Assessment
      • Data Protection Impact Assessments

    • 8.3 Carrying out privacy risk treatment

      Implement the privacy risk treatment plan and keep records of the outcome.

      • Risk Assessment
      • Data Protection Impact Assessments
      • Management Review of Risks

  • 9 Evaluating performance

    • 9.1 Monitoring and measurement

      Decide which aspects of privacy performance to monitor and measure, how and when, and evaluate the results.

      • Internal Audit
      • Security & Privacy Program Review

    • 9.2.1 Internal audits

      Audit the PIMS at planned intervals to confirm that it meets requirements and works effectively.

      • Internal Audit

    • 9.2.2 Internal audit programme

      Plan and run an audit programme with defined criteria, scope and frequency, objective auditors and reporting of results to management.

      • Internal Audit

    • 9.3.1 Management reviews

      Top management reviews the PIMS at planned intervals to confirm it is still suitable, adequate and effective.

      • Security & Privacy Program Review
      • Management Review of Policies

    • 9.3.2 Management review inputs

      The review considers earlier actions, internal and external changes, privacy performance, feedback, risks and improvement opportunities.

      • Security & Privacy Program Review
      • Management Review of Risks
      • Internal Audit

    • 9.3.3 Management review results

      The review produces recorded decisions on improvements and any changes needed to the PIMS.

      • Security & Privacy Program Review

  • 10 Improving the management system

    • 10.1 Ongoing improvement

      Keep improving how suitable, adequate and effective the PIMS is.

      • Security & Privacy Program Review
      • Internal Audit

    • 10.2 Correcting nonconformities

      Respond to nonconformities, remove their causes and confirm that corrective actions worked.

      • Internal Audit
      • Security & Privacy Program Review
      • Incident Tracking

• Annex A Reference controls

  • A.1 Controls for PII controllers

    • A.1.2 Lawful collection and processing

      • A.1.2.2 Documented processing purposes

        Identify and record the specific purposes for which each category of PII is processed.

        • Personal Data Inventory
        • Data Protection Policy & Procedure

      • A.1.2.3 Legal basis for processing

        Determine, record and be able to demonstrate the legal basis for each processing purpose.

        • Personal Data Inventory
        • Data Protection Policy & Procedure

      • A.1.2.4 Deciding how consent is obtained

        Decide and document when consent is required and how it will be collected.

        • Consent Management
        • Data Protection Policy & Procedure

      • A.1.2.5 Collecting and recording consent

        Obtain consent where it is required and keep a record showing it was given.

        • Consent Management

      • A.1.2.6 Assessing privacy impact

        Assess the privacy impact of new or changed processing before it starts, where the processing calls for it.

        • Data Protection Impact Assessments

      • A.1.2.7 Contracts with processors

        Contracts with PII processors set out what each processor must do to protect the PII it handles.

        • Processor Data Protection Agreements
        • Vendor Management Policy & Procedure

      • A.1.2.8 Joint controller arrangements

        Agree and document each party's privacy responsibilities when PII is processed together with another controller.

        • Contractual Obligations Register
        • Data Protection Policy & Procedure
        • Personal Data Inventory

      • A.1.2.9 Records of processing

        Keep records of processing activities that show how the organization meets its accountability obligations.

        • Personal Data Inventory

    • A.1.3 Duties toward individuals

      • A.1.3.2 Identifying obligations to individuals

        Identify and meet legal and contractual obligations to the people whose PII is processed, and give them a way to exercise their rights.

        • Data Subject Requests
        • Data Protection Policy & Procedure
        • Privacy Officer

      • A.1.3.3 Deciding what to tell individuals

        Determine and record what information individuals must receive about the processing of their PII, and when.

        • Published Privacy Policy
        • Privacy Notices on Data Collection Forms

      • A.1.3.4 Informing individuals

        Give individuals clear and accessible information about how their PII is processed.

        • Published Privacy Policy
        • Privacy Notices on Data Collection Forms
        • Conspicuous Privacy Notice Link

      • A.1.3.5 Changing or withdrawing consent

        Give individuals a simple way to change or withdraw their consent.

        • Consent Management

      • A.1.3.6 Objecting to processing

        Give individuals a way to object to the processing of their PII.

        • Data Subject Requests
        • Consent Management

      • A.1.3.7 Access, correction and erasure

        Let individuals access, correct or erase their PII where they are entitled to.

        • Data Subject Requests

      • A.1.3.8 Telling third parties about changes

        Inform third parties that received PII about corrections, erasures or withdrawn consent.

        • Data Subject Requests
        • Processor Data Protection Agreements

      • A.1.3.9 Copies of PII

        Provide individuals with a copy of their PII when they ask for it.

        • Data Subject Requests

      • A.1.3.10 Handling requests from individuals

        Define and follow procedures for receiving, handling and answering requests from individuals.

        • Data Subject Requests
        • Privacy Officer

      • A.1.3.11 Automated decisions

        Meet the obligations owed to individuals affected by decisions made solely through automated processing of their PII.

        • Data Subject Requests
        • Published Privacy Policy
        • Data Protection Impact Assessments

    • A.1.4 Privacy built into design and defaults

      • A.1.4.2 Limiting collection

        Collect only the PII that is relevant and necessary for the stated purposes.

        • Privacy by Design Policy
        • Personal Data Inventory

      • A.1.4.3 Limiting processing

        Keep processing of PII to what the identified purposes require.

        • Privacy by Design Policy
        • Personal Data Inventory
        • Identity Validation

      • A.1.4.4 Keeping PII accurate

        Keep PII accurate, complete and up to date for the purposes it serves.

        • Data Subject Requests
        • Personal Data Inventory

      • A.1.4.5 Minimization objectives

        Set and meet data minimization objectives, using techniques such as de-identification where possible.

        • Privacy by Design Policy
        • Test Data Protection

      • A.1.4.6 De-identifying or deleting after use

        Delete PII, or render it no longer identifying, once it is no longer needed.

        • Data Retention Policy
        • Privacy by Design Policy

      • A.1.4.7 Clearing temporary files

        Dispose of temporary files created during processing within a set period.

        • Data Retention Policy
        • Media Disposal Policy

      • A.1.4.8 Retention limits

        Keep PII no longer than its purposes require.

        • Data Retention Policy

      • A.1.4.9 Secure disposal of PII

        Follow documented procedures to dispose of PII securely.

        • Data Retention Policy
        • Media Disposal Policy

      • A.1.4.10 Protecting PII in transmission

        Protect PII sent over networks so that it reaches its destination without interception or alteration.

        • Transmission Confidentiality
        • Encryption Policy & Procedure

    • A.1.5 Sharing, transfers and disclosures

      • A.1.5.2 Basis for cross-border transfers

        Identify and document the legal basis for transferring PII between jurisdictions.

        • Cross-Border Data Transfers

      • A.1.5.3 Transfer destinations

        Identify and document the countries and international organizations to which PII may be transferred.

        • Cross-Border Data Transfers
        • Published Privacy Policy

      • A.1.5.4 Records of transfers

        Record transfers of PII to and from third parties.

        • Cross-Border Data Transfers
        • Personal Data Inventory

      • A.1.5.5 Records of disclosures

        Record disclosures of PII to third parties, including what was disclosed, to whom and when.

        • Personal Data Inventory
        • Data Subject Requests

  • A.2 Controls for PII processors

    • A.2.2 Processing on customer terms

      • A.2.2.2 Customer contract terms

        Contracts with customers describe how the processor helps the customer meet its own privacy obligations.

        • Contractual Obligations Register
        • Processor Data Protection Agreements

      • A.2.2.3 Processing only for customer purposes

        Process customer PII only for the purposes set out in the customer's documented instructions.

        • Data Protection Policy & Procedure
        • Contractual Obligations Register

      • A.2.2.4 Marketing and advertising

        Do not use customer PII for marketing or advertising without valid consent, and never make that consent a condition of the service.

        • Data Protection Policy & Procedure
        • Consent Management

      • A.2.2.5 Unlawful instructions

        Tell the customer when one of its processing instructions appears to breach privacy law.

        • Privacy Officer
        • Data Protection Policy & Procedure

      • A.2.2.6 Supporting customer obligations

        Give customers the information they need to show that they meet their own privacy obligations.

        • Contractual Obligations Register
        • Data Subject Requests
        • Data Protection Impact Assessments

      • A.2.2.7 Processing records

        Keep the records needed to show what processing was carried out for each customer.

        • Personal Data Inventory

    • A.2.3 Duties toward individuals

      • A.2.3.2 Supporting individuals' rights

        Give customers the means to meet their obligations to the individuals whose PII is processed.

        • Data Subject Requests
        • Privacy Officer

    • A.2.4 Privacy built into design and defaults

      • A.2.4.2 Clearing temporary files

        Delete temporary files created while processing customer PII within a set period.

        • Data Retention Policy
        • Media Disposal Policy

      • A.2.4.3 Return, transfer or disposal

        Return, transfer or securely dispose of customer PII as agreed, and make the policy for doing so available to customers.

        • Data Retention Policy
        • Media Disposal Policy
        • Contractual Obligations Register

      • A.2.4.4 Protecting PII in transmission

        Protect customer PII sent over networks so that it reaches its intended destination intact.

        • Transmission Confidentiality
        • Encryption Policy & Procedure

    • A.2.5 Sharing, transfers and disclosures

      • A.2.5.2 Basis for cross-border transfers

        Tell customers the basis for transferring their PII between jurisdictions, and of any change to it.

        • Cross-Border Data Transfers
        • Contractual Obligations Register

      • A.2.5.3 Transfer destinations

        Tell customers which countries and international organizations their PII may be transferred to.

        • Cross-Border Data Transfers
        • Publishing Security & Privacy Documentation

      • A.2.5.4 Records of disclosures

        Record disclosures of customer PII to third parties.

        • Personal Data Inventory
        • Data Subject Requests

      • A.2.5.5 Notifying disclosure demands

        Tell the customer about legally binding demands to disclose its PII, unless the law prohibits it.

        • Contractual Obligations Register
        • Privacy Officer

      • A.2.5.6 Legally binding disclosures

        Turn down requests to disclose customer PII that are not legally binding, unless the customer has authorized the disclosure.

        • Privacy Officer
        • Data Governance

      • A.2.5.7 Disclosing sub-processors

        Tell customers which sub-processors are used before they start processing customer PII.

        • Processor Data Protection Agreements
        • Publishing Security & Privacy Documentation

      • A.2.5.8 Engaging sub-processors

        Engage sub-processors only as the customer contract allows, and bind them to equivalent obligations.

        • Processor Data Protection Agreements
        • Third-Party Criticality Assessments
        • Vendor Management Policy & Procedure

      • A.2.5.9 Changing sub-processors

        Inform customers of planned changes to sub-processors so they have the chance to object.

        • Processor Data Protection Agreements
        • Contractual Obligations Register
        • Management Review of Third-Party Risks

  • A.3 Security controls for controllers and processors

    • A.3.3 Security policies and topic-specific policies

      Security policies address the protection of PII and are approved, published and reviewed.

      • Security Governance Program
      • Information Security & Privacy Policies
      • Management Review of Policies
      • Periodic Policy Acknowledgement
      • Data Protection Policy & Procedure

    • A.3.4 Security roles and duties

      Roles responsible for security and for PII protection are defined and assigned.

      • Assigned Security & Privacy Responsibilities
      • Roles & Responsibilities
      • Cybersecurity Responsibilities
      • Compliance Program Manager
      • People Operations Owner
      • Privacy Officer

    • A.3.5 Information classification

      The classification scheme explicitly accounts for PII.

      • Data Classification Policy
      • Data Classification Labels

    • A.3.6 Information labels

      Information containing PII is labelled so people can recognize it.

      • Data Classification Labels
      • Data Classification Policy

    • A.3.7 Transferring information

      Rules and agreements protect PII whenever it is transferred.

      • Transmission Confidentiality
      • Network Security Policy & Procedure
      • Third-Party Criticality Assessments

    • A.3.8 Managing identities

      Identities that can access PII are managed across their life cycle.

      • Identity Validation
      • User Access Reviews
      • Termination of Employment

    • A.3.9 Granting and reviewing access rights

      Access to PII is granted, reviewed and removed according to need.

      • Access Control Policy & Procedure
      • Identity Validation
      • User Privilege Reviews
      • User Access Reviews
      • Production System Access Review
      • Termination of Employment

    • A.3.10 Security terms in supplier agreements

      Supplier agreements include obligations to protect PII.

      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments
      • Subservice Organization Evaluation
      • Contractual Obligations Register
      • Processor Data Protection Agreements

    • A.3.11 Incident response planning

      Incident management plans cover breaches involving PII and the notifications they may require.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Automated Incident Reporting
      • Incident Reporting Assistance
      • Data Breach Notification Policy

    • A.3.12 Responding to incidents

      Incidents involving PII are handled, including any required notification to authorities, customers or individuals.

      • Incident Management Policy & Procedure
      • Incident Tracking
      • Breach Risk Assessment & Notification
      • PII Breach Notification Guidelines

    • A.3.13 Legal, regulatory and contractual obligations

      Legal and contractual requirements that affect PII are identified and met.

      • Data Governance
      • Statutory, Regulatory & Contractual Compliance
      • Contractual Obligations Register
      • Data Protection Policy & Procedure

    • A.3.14 Protecting records

      Records relating to PII processing are protected for as long as they are kept.

      • Policy Documentation Retention
      • Data Retention Policy
      • Statutory, Regulatory & Contractual Compliance

    • A.3.15 Independent security review

      The approach to protecting PII is reviewed independently at planned intervals.

      • Internal Audit
      • Security & Privacy Program Review
      • Penetration Testing

    • A.3.16 Conformance with security policies

      Compliance with PII protection policies is checked regularly.

      • Internal Audit
      • Management Review of Policies
      • Statutory, Regulatory & Contractual Compliance

    • A.3.17 Security awareness and training

      Staff are trained on PII protection relevant to their roles.

      • Security & Privacy Awareness
      • New Hire Security & Privacy Training
      • Periodic Security & Privacy Training

    • A.3.18 Confidentiality agreements

      People with access to PII are bound by confidentiality agreements.

      • New Hire Policy Acknowledgement
      • Periodic Policy Acknowledgement
      • Contractual Obligations Register

    • A.3.19 Clearing desks and screens

      PII is not left exposed on desks, printers or screens.

      • Clear Desk & Clear Screen
      • Session Lock

    • A.3.20 Storage media handling

      Media holding PII are managed and protected, and encrypted where appropriate.

      • Media Disposal Policy
      • Endpoint Encryption
      • Data Classification Policy

    • A.3.21 Disposal and reuse of equipment

      Equipment that held PII is wiped or destroyed before disposal or reuse.

      • Media Disposal Policy

    • A.3.22 Endpoint devices

      Devices that can access PII are secured.

      • Endpoint Security Policy
      • Malware Protection
      • Endpoint Security Validation
      • Endpoint Encryption
      • Session Lock

    • A.3.23 Authentication mechanisms

      Access to systems holding PII uses secure authentication.

      • Multi-Factor Authentication
      • Password Management Guidelines
      • Cloud Console Session Timeout

    • A.3.24 Backups

      Backups containing PII are protected and restorable, and restoration is controlled.

      • Data Backup Policy
      • Data Backups
      • Backup Restoration Testing

    • A.3.25 Logging activity

      Access to PII is logged, and the logs themselves are protected because they may contain PII.

      • Centralized Security Logging
      • Anomalous Behavior Detection

    • A.3.26 Cryptography

      PII is encrypted where appropriate, with keys managed securely.

      • Encryption Policy & Procedure
      • Encryption of Data at Rest
      • Transmission Confidentiality
      • Endpoint Encryption

    • A.3.27 Secure development process

      Privacy is considered throughout the development life cycle.

      • Change Management Policy & Procedure
      • Secure System Modification
      • Approval of Changes
      • Privacy by Design Policy

    • A.3.28 Security requirements for applications

      Application requirements include the protection of PII.

      • Change Management Policy & Procedure
      • Input Range Validation
      • Mandatory Field Validation
      • Vulnerability Remediation Process
      • Privacy by Design Policy

    • A.3.29 Secure architecture and engineering

      Systems are designed with privacy by design and by default.

      • Change Management Policy & Procedure
      • Network & Data Flow Diagrams
      • Privacy by Design Policy

    • A.3.30 Supervising outsourced development

      Outsourced development follows the organization's PII protection requirements.

      • Vendor Management Policy & Procedure
      • Third-Party Criticality Assessments
      • Change Management Policy & Procedure
      • Approval of Changes

    • A.3.31 Test data

      PII used for testing is avoided or protected to the same standard as production.

      • Test Data Protection