ISO 27701 LA cheat sheet

PII (personally identifiable information) is information that can identify a PII principal directly or indirectly, alone or when combined with other information; ISO/IEC 29100 uses the wider term 'PII' where many laws use 'personal data'.

Three core roles: PII principal (the individual the PII relates to), PII controller (determines purposes and means of processing, alone or jointly), PII processor (processes PII on the controller's documented instructions).

ISO/IEC 27701 is a sector-agnostic extension to ISO/IEC 27001 and ISO/IEC 27002: it does not replace the ISMS but adds PIMS-specific requirements and guidance on top of it.

ISO/IEC 29100 defines eleven privacy principles: consent and choice; purpose legitimacy and specification; collection limitation; data minimisation; use, retention and disclosure limitation; accuracy and quality; openness, transparency and notice; individual participation and access; accountability; information security; privacy compliance.

Privacy risk is the combination of the likelihood and the consequences of PII principals experiencing privacy problems (ISO/IEC 29134); it is assessed from the principal's perspective, not only the organization's.

Accountability rule: the controller remains accountable for PII processed by processors, so outsourcing processing does not transfer accountability for the PII.

Privacy by design and by default means privacy is embedded in the design of processes and systems and default settings are the most privacy-protective option (for example, minimum data collected and shortest retention).

ISO/IEC 27701 does not certify legal compliance; its GDPR and ISO/IEC 27018/29151 correspondences are informative mappings, and meeting legal obligations stays the organization's responsibility.

The standard applies to any organization regardless of size or sector, acting as PII controller, PII processor, or both for different processing activities.

ISO/IEC 27701 Clauses 4 to 10 extend ISO/IEC 27001 Clauses 4 to 10 with PIMS-specific requirements; a functioning ISMS is therefore a prerequisite for a PIMS.

Clause 5.2 splits the privacy policy requirement by role: 5.2.1 for organizations acting as PII controller and 5.2.2 for organizations acting as PII processor; top management must establish, communicate and maintain it.

Clause 6 requires privacy risk assessment and treatment integrated with the ISMS risk process, plus PIMS objectives established at relevant functions and levels and plans to achieve them.

Clause 7 adds PIMS-specific support requirements: competence for privacy roles, awareness of the privacy policy and obligations to PII principals, communication, and documented information.

Clause 8 covers operational planning and control: implementing privacy risk treatment, maintaining records of PII processing, and operating the Annex A controls.

Annex A is normative and structured by role: A.1 contains PIMS-specific requirements for PII controllers, A.2 contains PIMS-specific requirements for PII processors; both apply where the organization acts in both roles.

Annex B is informative and gives implementation guidance for the Annex A requirements, structured in correspondence with ISO/IEC 27002 control themes (for example conditions for collection and processing, obligations to PII principals, privacy by design and default, PII sharing, transfer and disclosure).

Documented information typically required by a PIMS includes the PIMS scope, privacy policy, role assignments and responsibilities, records of PII processing, risk assessment and treatment results, and evidence of competence and awareness.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

ISO 19011 defines seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Audit types by relationship: first-party (internal), second-party (by an interested party such as a customer or supplier) and third-party (certification or accreditation); certification audits must be third-party and independent of the auditee.

Objective evidence is records, statements of fact or other verifiable information; findings must be traceable to evidence, and sampling size and selection must be justifiable.

Findings are graded as conformity, nonconformity (major or minor) or observations/opportunities for improvement; a major nonconformity affects the management system's ability to achieve intended results or creates significant doubt about the effectiveness of controls.

Audit team roles: lead auditor (manages the audit and reports), auditors, technical experts (advise but do not audit), observers, and guides provided by the auditee.

Risk-based auditing rule: allocate audit time and auditor attention to processes with higher privacy risk and greater complexity, and verify evidence of effectiveness rather than mere documentation.

Auditor competence for a PIMS audit includes PII protection and privacy legislation knowledge, sector knowledge, and audit techniques; ISO/IEC 27006-1 sets the certification-body requirements for ISMS/PIMS audits.

Distinguish the audit programme (a set of audits over a cycle, with objectives, resources and schedule) from the audit plan (logistics and arrangements for one audit: dates, sites, functions, auditors, times).

Audit criteria for a 27701 audit are normally ISO/IEC 27701 clauses and Annex A together with ISO/IEC 27001 (since 27701 is an extension), plus the organization's privacy policy, documented information and applicable legal or contractual obligations.

Stage 1 reviews documented information, PIMS scope, controller/processor role determination, risk assessment and readiness, and decides whether stage 2 can proceed; stage 2 evaluates implementation and effectiveness.

Determine audit time from ISO/IEC 27006-1 factors such as scope, complexity, number of sites, number of personnel, PII volume and sensitivity, and use of processors; reductions must be justified and recorded.

Pre-audit document review should cover the PIMS scope, privacy policy, Statement of Applicability, records of PII processing, risk treatment results, role assignments and previous audit findings.

Prepare work documents mapped to the Annex A sections applicable to the auditee's role (A.1, A.2 or both) and to the organization's PII processing lifecycle, and define the sampling approach for processes and sites.

Agree confidentiality and PII handling arrangements before fieldwork: auditors must not copy or remove PII, and access to records containing PII must be controlled.

For combined or integrated ISO/IEC 27001 plus ISO/IEC 27701 audits, plan to audit shared clauses once and to audit the PIMS-specific additions separately, avoiding duplication and allocating sufficient total audit time.

The opening meeting confirms audit objectives, scope, criteria, schedule, methods, communication channels, confidentiality and safety arrangements, and the availability of guides.

Evidence is collected by interview, observation of activities and controls, and review of documents and records; conclusions should be supported by more than one source or type of evidence.

Sample across the PII lifecycle (collection, use, retention, disclosure, transfer, deletion) and verify consistency between stated purposes, notices given to PII principals, and actual processing.

Verify role-specific obligations: for controllers, purpose specification, notice, lawful basis/consent and handling principal access requests; for processors, processing only on documented instructions, sub-processor controls, assistance to the controller, and deletion or return of PII.

Assess effectiveness, not just existence: records must show the control operated consistently over the audit period, including outsourced processing and remote or cloud environments.

Record each finding with the criterion, the objective evidence (what, where, when, who) and the graded nonconformity level, applying grading criteria consistently across the audit.

Communicate findings to the auditee during the audit and confirm factual accuracy of the evidence; the auditor determines the grade, and unresolved disagreements are recorded in the report.

Protect PII encountered during audit activities: use anonymised or redacted samples where possible, minimise recorded personal details, and store audit evidence securely.

The lead auditor controls progress, may reassign resources, and must record any limitation or deviation from the audit plan that affects the reliability of conclusions.

The closing meeting presents findings, nonconformity grading, audit conclusions and any recommendation, and explains the timelines and method for correction and corrective action.

The audit report should state objectives, scope, criteria, team and dates, summarise findings and evidence, give conclusions on conformity, and note limitations and any unresolved disagreements.

The certification decision is made by the certification body, not the audit team, based on the audit report and verification of corrective action, and must be independent of the audit personnel.

Major nonconformity rule: correction and corrective action are normally verified before certification; minor nonconformities may be accepted through a verified corrective action plan with effectiveness checked at a later audit.

Verification of corrective action may be a documentary review or a follow-up on-site audit, depending on the severity of the nonconformity and the risk it presents.

The scope statement of the certificate must reflect the PIMS and the PII roles covered (controller and/or processor) and any exclusion that limits applicability of Annex A sections.

After initial certification the first surveillance audit falls no later than 12 months from the certification decision date, with at least one surveillance per calendar year and recertification before the three-year cycle expires.

Confidentiality and record-retention obligations continue after the audit and after any suspension or withdrawal of certification; audit records containing PII must be protected.

An audit programme is the arrangements for a set of audits planned for a specific time frame and purpose; a person must be assigned responsibility and authority to manage it.

Programme design inputs include the programme objectives, the auditee's risks and PII processing complexity, scope and number of sites, prior audit results, legal and regulatory context, and interested-party expectations.

A certification programme runs as a three-year cycle: initial certification (stage 1 and stage 2), surveillance audits at least annually, and recertification before the certificate expires.

Programme resources to plan include auditor competence and team composition, technical experts, audit time, travel logistics, and analysis of threats to impartiality.

ISO/IEC 27006-1 supplies the sector-specific requirements for bodies auditing ISMS/PIMS, including audit time determination, competence criteria, multi-site sampling and use of technical experts.

Monitor and review the programme against indicators such as adherence to schedule, nonconformity rates, complaint and appeal handling, report timeliness, and changes in the auditee's scope or risk profile.

Impartiality controls: certification bodies must not provide management system consultancy to clients they certify, must analyse conflicts of interest, and must not let commercial pressure influence decisions.

Justify and document combined or integrated audits and any reduction in audit time; the total auditor time must still be sufficient to cover the ISMS and the PIMS-specific requirements.