ISO 27701 LI cheat sheet

ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002: it adds privacy-specific requirements and guidance on top of an existing ISMS rather than replacing it.

27701 has two normative parts: Clause 5 (PII controller requirements and guidance) and Clause 6 (PII processor requirements and guidance), each with an annex of controls (Annex A for controllers, Annex B for processors).

Key roles: PII principal (the individual the data is about), PII controller (determines purposes and means), PII processor (processes on the controller's behalf), and joint PII controller (two or more controllers jointly determining purposes and means).

Core privacy principles underpinning the standard: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability, and privacy by design and by default.

A PIMS is the part of the overall management system that governs privacy - it uses the same Plan-Do-Check-Act structure as the ISMS and shares its risk assessment, documented information, and management review processes.

Annex A/B controls are organised into control areas mapped to ISO/IEC 27002 themes: conditions for collection and processing, obligations to PII principals, privacy by design, PII sharing/transfer/disclosure, and PII processor-specific controls.

PIMS scope must be defined in terms of organisational boundaries, locations, and the PII processing activities covered; the PIMS cannot be scoped more narrowly than the ISMS it extends.

Accountability means the controller must be able to demonstrate compliance, not merely comply - records, policies, assessments, and audit evidence are the demonstration mechanism.

Privacy risk is assessed from the perspective of the PII principal (harm to individuals), which is distinct from information security risk assessed from the perspective of the organisation.

Initiation requires a mandate: documented top-management commitment, a named PIMS sponsor, and a decision on whether to extend an existing ISO/IEC 27001 ISMS or build both together.

A gap analysis compares current privacy practices against 27701 Clauses 5/6 and Annexes A/B; outputs feed the implementation roadmap and resourcing plan.

Define the PIMS scope statement early, including organisational units, products/services, locations, and the categories of PII and PII principals in scope.

Identify and map applicable legal and regulatory obligations (e.g., GDPR, CCPA/CPRA, LGPD, PIPL, sector rules) plus contractual obligations from customers - these become inputs to the privacy risk assessment.

Establish governance: appoint a privacy officer/DPO where required, define roles and responsibilities, and set up a steering or working group with representatives from legal, IT, security, HR, and business owners.

Build a PII inventory / record of processing activities (ROPA) as the foundational artefact; without knowing where PII lives and why, scoping and risk assessment are unreliable.

Secure resources and budget, agree the implementation timeline and milestones, and define success criteria and reporting lines to top management.

Decide the certification body and target timeline early enough that audit logistics (stage 1/stage 2) do not become the critical path.

Planning follows Clause 6 of ISO/IEC 27001 (risk and opportunity planning) plus 27701 Clause 5.2/6.2 privacy-specific planning requirements for controllers and processors.

The privacy risk assessment methodology must be documented: criteria for likelihood and impact, how harm to PII principals is evaluated, and who accepts residual risk.

Risk treatment options include applying Annex A/B controls, contractual safeguards, technical measures (encryption, pseudonymisation, access control), and organisational measures; each treatment maps to a Statement of Applicability entry.

The Statement of Applicability lists all Annex A/B controls with justification for inclusion or exclusion and implementation status - it is a mandatory audited document.

Objectives and KPIs must be measurable (e.g., % of ROPAs complete, % of DSARs answered within statutory deadline, number of privacy incidents, training completion rate).

Plan must allocate responsibilities via a RACI or similar, define dependencies on the ISMS, and set a training and awareness programme for all staff handling PII.

Planning must address PII principal rights processes (access, rectification, erasure, objection, portability) and the operational procedures and SLAs to deliver them.

Define the supplier/processor management plan: due diligence, contract clauses, and monitoring of sub-processors, since controller obligations flow down to processors.

Implementation executes the plan: deploy Annex A/B controls, produce documented information (policies, procedures, records), and operate the processes defined in Clauses 5 and 6.

Controller-specific controls (Annex A) cover lawful basis determination, consent management, purpose limitation, PII minimisation, retention schedules, and transparency notices to PII principals.

Processor-specific controls (Annex B) cover processing only on documented instructions, assisting the controller with DSARs and DPIAs, breach notification to the controller, sub-processor management, and return/deletion of PII at contract end.

Privacy by design and by default must be embedded in engineering and procurement: DPIA triggers, data protection impact assessments, and privacy requirements in project gates.

Operationalise incident management to include personal data breach detection, assessment, containment, and notification within statutory timelines (e.g., 72 hours under GDPR to the supervisory authority where required).

Maintain the ROPA, PII inventory, retention/disposal records, training records, and supplier assessments as controlled documented information with version control and retention rules.

Implement monitoring hooks during deployment - logging, metrics, and evidence capture - so that Clause 9 monitoring can run without retrofitting.

Ensure competence and awareness: role-based training, confidentiality undertakings, and records of competence for staff with privacy responsibilities.

Clause 9 requires monitoring, measurement, analysis, and evaluation of privacy performance, with documented evidence of what is monitored, the methods used, when it is done, and who analyses results.

Internal audit (Clause 9.2) must be planned and executed on a programme covering the PIMS scope, with auditor independence and documented results reported to management.

Management review (Clause 9.3) inputs include audit results, KPI performance, privacy incidents, risk assessment status, interested-party feedback, and corrective action status; outputs include decisions and resource actions.

Typical privacy metrics: DSAR response times, breach counts and notification timeliness, DPIA completion rate, training coverage, supplier assessment coverage, and control testing results.

Monitoring includes ongoing control effectiveness testing (e.g., access reviews, retention deletion verification, consent record sampling) - not just collecting statistics.

Nonconformities and incidents identified during monitoring feed the corrective action process (Clause 10.1) with root cause analysis and verification of effectiveness.

Evidence must be retained as documented information so it can be presented at certification audit; undocumented monitoring is treated as not performed.

Review frequency should be risk-based; high-risk processing (large-scale sensitive data, new technology) warrants more frequent monitoring.

Clause 10 covers nonconformity and corrective action (10.1) and continual improvement (10.2); improvement is a required, evidenced process, not optional.

Corrective action steps: react to the nonconformity, evaluate the need to eliminate the cause, implement action, review effectiveness, and update risks if needed - all recorded.

Improvement inputs include internal/external audit findings, management review outputs, privacy incidents and near misses, regulatory changes, new technology, and PII principal complaints.

Regulatory change monitoring is a continual improvement driver: new laws, guidance, or supervisory authority decisions trigger reassessment of controls and documentation.

Lessons learned from breaches should update risk assessments, DPIAs, training content, and technical controls; closure is only valid once effectiveness is verified.

Performance trends from Clause 9 metrics identify systemic weaknesses that individual corrective actions may miss; trend analysis should be a management review input.

Improvement must be reflected in updated documented information (policies, SoA, ROPA, risk register) so the PIMS stays consistent with actual practice.

Opportunities for improvement (not just corrective actions for failures) should be captured and prioritised alongside nonconformities.

Certification is a two-stage process by an accredited certification body: Stage 1 (documentation and readiness review) and Stage 2 (implementation effectiveness audit), followed by surveillance audits in the certification cycle.

The certification scope statement must match the PIMS scope and be consistent with the ISO/IEC 27001 certificate where the PIMS is an extension; auditors check alignment between the two.

Mandatory evidence typically reviewed: scope, privacy policy, risk assessment and treatment, Statement of Applicability, ROPA, DPIA records, internal audit reports, management review minutes, incident and corrective action records, training records, and supplier contracts.

Conduct a pre-certification internal audit and management review within a reasonable period before Stage 2 - auditors expect these to be complete and effective, not planned.

Prepare staff for interviews: auditors sample across roles and will test whether people know their privacy responsibilities, how to report incidents, and how DSARs are handled.

Be ready to demonstrate the link between Annex A/B controls and the SoA, including justification for any excluded controls - unjustified exclusions are a common finding.

Resolve open nonconformities and verify effectiveness before the audit; unresolved major nonconformities typically prevent certification.

Confirm certification body accreditation covers ISO/IEC 27701 and agree audit duration, sampling of sites, and remote vs on-site arrangements in advance.