ISO 27701 LI flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

PII principal

The individual to whom personal data relates. ISO/IEC 27701 uses this term instead of 'data subject' to keep the standard technology- and jurisdiction-neutral across privacy laws worldwide.

PII controller

The organisation, public authority, agency, or other body that alone or jointly determines the purposes and means of processing PII. It carries primary accountability for lawfulness and transparency.

PII processor

An entity that processes PII on behalf of and on the documented instructions of a PII controller. It does not determine purposes and must not use the data for its own purposes.

Joint PII controllers

Two or more controllers that jointly determine the purposes and means of processing. They must transparently allocate responsibilities among themselves, particularly for handling PII principal rights requests.

Annex A vs Annex B

Annex A contains control guidance for PII controllers; Annex B contains control guidance for PII processors. Organisations acting in both roles must apply both sets of controls.

Privacy by design

Embedding privacy protections into systems, processes, and products from the outset rather than retrofitting them. It is a control area in ISO/IEC 27701 Annexes A and B.

Privacy risk

The risk of harm to PII principals arising from processing, assessed separately from organisational information security risk. It considers likelihood and impact of harms such as discrimination, reputational damage, or financial loss.

PIMS scope statement

Documented definition of organisational boundaries, locations, products, and PII processing activities covered by the privacy information management system. It cannot be narrower than the underlying ISMS scope.

Gap analysis

A structured comparison of current privacy practices against ISO/IEC 27701 requirements and Annex controls. Its output prioritises remediation work and sizes the implementation programme.

Record of processing activities

A structured inventory of processing activities describing purposes, categories of PII and principals, recipients, retention periods, and security measures. It is foundational for scoping and risk assessment.

Top management mandate

Documented commitment and sponsorship from senior leadership authorising the PIMS programme, allocating resources, and defining accountability. Certification audits expect evidence of this commitment.

Legal and regulatory register

A maintained list of privacy laws, regulations, and contractual obligations applicable to the organisation's processing. It feeds the risk assessment and is updated as requirements change.

Privacy risk assessment

A documented process for identifying and evaluating risks to PII principals, using defined likelihood and impact criteria. Results determine which Annex controls are selected and how they are implemented.

Statement of Applicability

A mandatory document listing all Annex A and B controls with justification for inclusion or exclusion and current implementation status. Auditors test its consistency with actual practice.

Risk treatment plan

A plan specifying how selected controls, contractual measures, and technical safeguards will reduce privacy risks to acceptable levels, including owners, deadlines, and residual risk acceptance.

Measurable privacy objectives

Quantified targets such as DSAR response rate, breach notification timeliness, and training coverage. They must be monitored and reported so effectiveness can be demonstrated at audit.

Supplier due diligence

Assessment of processors and sub-processors before engagement and periodically thereafter, covering security, privacy practices, and contractual obligations. Results are retained as documented evidence.

Data protection impact assessment

A structured assessment required for high-risk processing, evaluating necessity, proportionality, and risks to PII principals, plus mitigations. It is a privacy-by-design control under Annex A.

Consent management

Procedures for obtaining, recording, and withdrawing consent where consent is the lawful basis, including evidence of when and how it was given and honoured.

Retention and disposal schedule

Defined retention periods per PII category, with documented deletion or anonymisation at expiry. Auditors sample records to verify deletion actually occurs as scheduled.

Personal data breach notification

The process for detecting, assessing, containing, and notifying breaches to regulators and PII principals within statutory deadlines, and to controllers where the organisation is a processor.

Processor documented instructions

The contractual and operational basis on which a processor may handle PII. Processing outside those instructions is a control failure and must be reported to the controller.

Transparency notice

Information provided to PII principals about purposes, lawful basis, recipients, retention, and rights. It must be concise, accessible, and available at the point of collection.

Internal audit programme

A planned schedule of independent audits covering the full PIMS scope over a defined cycle. Results, including nonconformities, are reported to top management.

Management review inputs

Required agenda items including audit results, KPI performance, incidents, risk status, interested-party feedback, and corrective action status. Outputs record decisions and resource allocations.

Control effectiveness testing

Verification that implemented controls actually work, for example by sampling access reviews or testing deletion jobs. It goes beyond collecting statistics and produces audit-ready evidence.

Monitoring and measurement plan

Documentation of what is monitored, the methods and metrics used, frequency, and who analyses results. ISO/IEC 27701 Clause 9 requires this to be defined and evidenced.

Nonconformity

Failure to meet a requirement of ISO/IEC 27701 or the organisation's own PIMS processes. It must be recorded, corrected, and analysed for root cause under Clause 10.1.

Corrective action

Action taken to eliminate the cause of a nonconformity so it does not recur. Effectiveness must be reviewed and documented; closure without verification is a common audit finding.

Continual improvement

The ongoing process of enhancing PIMS performance using audit findings, incidents, metrics trends, and regulatory change. Clause 10.2 requires it to be planned and evidenced.

Regulatory change monitoring

Tracking new laws, guidance, and supervisory decisions that affect processing, then reassessing risks and controls. It is a key input to continual improvement.

Stage 1 certification audit

The first certification audit stage, reviewing documentation, scope, and readiness to confirm the organisation is prepared for the Stage 2 effectiveness assessment.

Stage 2 certification audit

The main certification audit that tests whether the PIMS is implemented and effective, through interviews, sampling, and evidence review across the certification scope.