ISO 27701 LA key terms

A management system that governs how an organisation handles personally identifiable information, built by extending an ISO/IEC 27001 information security management system with privacy-specific requirements and controls.

Any information that can identify a person, directly or indirectly, alone or combined with other data, such as names, identifiers, location data or attributes tied to a natural person.

The natural person to whom particular personally identifiable information relates; the individual whose privacy the management system exists to protect.

The organisation or body that alone, or with others, determines the purposes and means of processing personally identifiable information, and therefore carries primary accountability for that processing.

An organisation that processes personally identifiable information on behalf of, and under the instructions of, a PII controller, without deciding why or how the processing happens.

An approach that builds privacy protection into systems, processes and products from the outset, rather than adding it after design and deployment are complete.

The legal ground, such as consent, contract or legitimate interest, that justifies processing personally identifiable information; processing without one is generally prohibited.

A freely given, specific, informed and unambiguous indication of a PII principal's agreement to processing, given by clear affirmative action and withdrawable at any time.

The principle that personally identifiable information is collected for specified, explicit and legitimate purposes and is not reused for incompatible purposes without a new lawful basis.

The principle that processing is limited to personally identifiable information that is adequate, relevant and necessary for the stated purpose, and no more.

Replacing identifying attributes with artificial identifiers so that data can no longer be attributed to a person without additional information kept separately and protected.

The likelihood and impact of harm to individuals arising from processing personally identifiable information, considered separately from risks to the organisation's own assets or operations.

A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personally identifiable information.

A structured evaluation of the privacy risks of a proposed or changed processing activity, used to decide whether safeguards or consultation are required before it starts.

A document listing the applicable controls, justifying inclusion or exclusion of each and describing implementation status; it accompanies the risk assessment in an ISO/IEC 27001-based system.

A measure that modifies privacy risk, implemented through policies, procedures, technical safeguards or organisational arrangements; ISO/IEC 27701 adds privacy-specific controls to the information security set.

The documented boundaries covering organisational units, locations, technologies and processing activities covered by the privacy information management system; auditors test whether the statement matches what actually happens.

A top-management evaluation, at planned intervals, of the management system's suitability, adequacy and effectiveness, including privacy performance, risks and opportunities for improvement.

The set of requirements, policies, procedures or standards used as a reference against which audit evidence is compared to determine conformity.

Records, statements of fact or other information that is relevant to the audit criteria and verifiable; it forms the basis on which audit findings are made.

The result of evaluating collected audit evidence against audit criteria, which may indicate conformity or nonconformity and is reported to the auditee.

Non-fulfilment of a requirement, whether the requirement comes from the standard, the organisation's own procedures or a legal obligation; it must be recorded with objective evidence.

A nonconformity that affects the capability of the management system to achieve intended results, or creates significant doubt about the effectiveness of controls, typically blocking certification.

A single lapse or isolated weakness that does not by itself undermine the management system's ability to deliver intended results but still requires correction.

The auditor's professional judgement summarising how the audit objectives were met, based on the findings and on how significant those findings are.

Freedom from bias, conflict of interest or pressure that could influence audit judgements, which is why auditors must not audit their own work.

Basing every audit finding and conclusion on verifiable information obtained through sampling, interview and observation, rather than on assumption, opinion or hearsay.

A set of planned audits for a defined period, directed at a specific purpose, including schedules, resources, criteria and arrangements across a certification cycle.

A description of the activities and arrangements for a single audit, including objectives, criteria, scope, timing, team roles and the sampling approach to be used.

The purpose of an individual audit, such as verifying conformity with criteria, evaluating control effectiveness or assessing readiness for certification.

The early examination of policies, procedures, risk assessments and records to understand the auditee's system and identify areas needing deeper verification later.

Selecting a subset of items from a larger population to draw conclusions about the whole; the sample must be representative and the rationale recorded.

A short formal meeting at the start of the audit to confirm objectives, scope, criteria, schedule, roles, confidentiality arrangements and how findings will be reported.

A planned conversation with auditee personnel used to gather evidence, clarify how activities are actually performed and probe gaps between documented and actual practice.

The final meeting of an audit where findings, nonconformities and the audit conclusion are presented, and the auditee is informed of follow-up requirements.

The formal record of an audit covering objectives, scope, criteria, evidence examined, findings, nonconformities and conclusions, issued to the auditee and the client.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur, including root cause analysis, implementation and verification of effectiveness.

A periodic audit after initial certification, carried out at least annually, to confirm that the management system continues to conform and remain effective.

The demonstrated personal attributes plus the ability to apply knowledge and skills; privacy auditors need privacy and information security knowledge combined with audit technique.