ISO 27701 LA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PII principal

The individual to whom personally identifiable information relates; ISO/IEC 27701 uses this term instead of 'data subject' to stay technology-neutral and independent of any single legal system.

PII controller

An entity that alone or jointly with others determines the purposes and means of processing PII, and therefore carries accountability for that processing.

PII processor

An entity that processes PII on behalf of, and on the documented instructions of, a PII controller, without determining the purposes or the essential means of processing.

Joint PII controller

Two or more organizations that jointly determine the purposes and means of PII processing and therefore share accountability for the processing and its outcomes.

Privacy by design and default

An approach requiring privacy to be embedded in the design of systems and processes, with default settings set to the most privacy-protective option without user intervention.

Accountability principle

The principle that a controller remains answerable for PII it processes, including processing performed by processors on its behalf, and must be able to demonstrate compliance.

ISO/IEC 29100 principles

Eleven privacy principles including consent and choice, purpose legitimacy, collection limitation, data minimisation, use and retention limitation, accuracy, openness, individual participation, accountability, information security and privacy compliance.

Annex A (ISO/IEC 27701)

The normative part of ISO/IEC 27701 containing PIMS-specific requirements: A.1 for organizations acting as PII controllers and A.2 for organizations acting as PII processors.

Annex B (ISO/IEC 27701)

The informative part of ISO/IEC 27701 giving implementation guidance for the Annex A requirements, structured in correspondence with ISO/IEC 27002 control themes.

PIMS scope statement

Documented information defining the boundaries of the privacy information management system, including which PII processing activities, roles, locations and entities it covers.

Privacy policy (PIMS)

A top-management document stating the organization's privacy commitments; ISO/IEC 27701 clause 5.2.1 covers controllers and clause 5.2.2 covers processors.

Statement of Applicability

A document recording which ISO/IEC 27001 and ISO/IEC 27701 Annex A controls are applicable, the justification for inclusion or exclusion, and their implementation status.

Audit criteria

The set of requirements used as a reference against which objective evidence is compared, for example ISO/IEC 27701, the organization's privacy policy, contracts and applicable privacy law.

Objective evidence

Records, statements of fact or other verifiable information about activities, events or conditions that is relevant to the audit criteria and can be corroborated.

Major nonconformity

A nonconformity that affects the management system's ability to achieve intended results or creates significant doubt about the effectiveness of controls, requiring correction and corrective action.

Evidence-based approach

The audit principle that findings and conclusions must rest on verifiable, representative objective evidence rather than on opinion, impression or unverified assertion.

Technical expert

A person providing specific privacy, legal or sector knowledge or expertise to the audit team, who advises the auditors but does not act as an auditor.

Audit programme

Arrangements for a set of one or more audits planned for a specific time frame and directed at a specific purpose, including resources and schedule.

Audit plan

A description of the activities and arrangements for a specific audit, covering dates, sites, functions to be audited, auditor allocation and the audit schedule.

Stage 1 audit

The initial audit phase that reviews documented information, PIMS scope, controller or processor role determination and readiness, to decide whether stage 2 can proceed.

Audit time determination

Calculation of the auditor time needed, based on factors such as scope, complexity, number of sites, personnel, PII volume and sensitivity, and prior audit results.

Opening meeting

The meeting at the start of the audit at which scope, criteria, schedule, methods, roles, communication channels and confidentiality arrangements are confirmed with the auditee.

Audit sampling

Selecting a representative subset of records, sites or activities for verification; the size and selection must be justified and conclusions are limited to the sample.

Audit trail

The documented link from each finding back to the objective evidence and the criterion that supports it, allowing the conclusion to be traced and re-verified.

Documented processor instructions

The requirement that a PII processor processes PII only on the controller's documented instructions, including for transfers to third parties or other countries.

Audit conclusion

The outcome of an audit, determined after considering the audit objectives and all findings, stating the extent of conformity with the audit criteria.

Certification decision

A decision by the certification body, independent of the audit team, to grant, maintain, suspend or withdraw certification, based on the audit report and related evidence.

Surveillance audit

A periodic audit after initial certification; the first occurs no later than twelve months from the certification decision date, and at least one takes place each calendar year.

Corrective action verification

Confirmation, by documentary review or follow-up audit, that the correction and corrective action for a nonconformity have been implemented and are effective.

Impartiality in certification

The absence of conflicts of interest; certification bodies must not consult clients they certify and must identify, analyse and control threats to objectivity.

Audit programme manager

The person assigned responsibility and authority for managing the audit programme, including its implementation, resourcing, monitoring, review and improvement.

Certification cycle

The three-year period of a certificate, typically comprising initial certification with stage 1 and stage 2, annual surveillance audits, and recertification before expiry.