Scoping a PIMS When the Organization Is Both Controller and Processor

Criteria applied

• ISO/IEC 27701 requires the organization to determine, and document, whether it acts as PII controller, PII processor, or both, for each processing activity.
• Annex A (PII controller) and Annex B (PII processor) then apply according to those determinations; the Statement of Applicability must be traceable to them.
• Scope must be accurate and must not mislead users of the certificate.

Analysis

• Patient records: processor only - clients set purpose and means. Annex B applies.
• Newsletter to 240,000 contacts: the company sets the purpose and lawful basis and selects the audience. This is controller activity. Annex A applies.
• Recruitment candidate files: controller activity (the company is the employer/recruiter of record). Annex A applies.

Conclusion The exclusion of Annex A is not justifiable: real controller processing exists inside the defined scope and is performed on the same infrastructure. The scope statement is also inaccurate because it states only one role. This is a nonconformity against the PIMS requirements for role determination and against the Statement of Applicability, and it must be resolved before a certification recommendation can be made.

A sentence in the scope statement does not remove an activity that continues to exist inside the organization and uses the same people, systems and data stores. Two outcomes are possible, and they are not equivalent:

1. The activity genuinely leaves the scope boundary - e.g. the newsletter is legally and operationally transferred to another entity, with no residual access to the shared platform. Then exclusion may be defensible, but it must be justified, documented in the Statement of Applicability, and supported by the risk assessment and by interested-party requirements (hospital clients may require a single accountable party).
2. The activity continues - then it must be in scope. A scope statement that omits it is misleading, and certifying against it would misrepresent what has been assessed.

As auditor you should:

• Record the factual state (activities, roles, systems) rather than accept the wording.
• Check whether the risk assessment covers the marketing and recruitment processing, and whether interested-party and legal requirements were considered.
• Require the scope statement, the role determination and the Statement of Applicability to be internally consistent before Stage 2 or before a certification decision.

If the client refuses, report the scope limitation to the certification body; you cannot audit and report on a scope you believe to be inaccurate.

The revised scope adds a whole Annex A control set and the corresponding Clause 6 guidance areas, which were previously unexamined. Plan additional time and sampling:

• Purpose and lawful basis for the newsletter and recruitment processing; how both are identified and recorded.
• Consent records - evidence of how consent was obtained and recorded, and whether the withdrawal mechanism works (test it, do not take the description).
• Records of processing covering marketing and recruitment, and their linkage to the risk assessment.
• Privacy impact assessment for any high-risk processing, including profiling for segmentation.
• Obligations to PII principals - access, correction, erasure, objection; verify response times against the organization's stated commitments.
• Retention and disposal - evidence that newsletter contacts and unsuccessful candidate files are actually deleted.
• Sharing and disclosure - list brokers, enrichment suppliers, transfer mechanisms; the controller-side view of the same suppliers previously examined only as a processor.
• Interface risk - where the two roles touch the same platform, check for contamination (e.g. marketing data in a client's tenant), which is where a combined audit adds most value.

Also confirm that internal audit and management review covered the controller role before Stage 2.