Fundamental principles and concepts of a PIMS
Domain 1 tests whether you can explain what a PIMS is, how ISO/IEC 27701 relates to ISO/IEC 27001 and 27002, and why privacy needs management-system requirements rather than a policy alone. A PIMS is the part of the management system that governs PII processing: it identifies PII flows, assigns accountability, and controls risks to PII principals as well as to the organisation.
Core concepts
- ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002, not a replacement. The ISMS requirements still apply; 27701 adds PIMS-specific requirements and guidance.
- PII is information relating to an identified or identifiable natural person, the PII principal. Pseudonymised data can still be PII where linkage is possible.
- A PII controller determines purposes and means of processing; a PII processor processes on the controller's behalf. An organisation can act in both roles for different processing.
- Privacy principles include purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability, privacy by design and by default, and transparency.
- In the 2019 edition, controls are organised for controllers in Annex A, processors in Annex B, and both in Annex C.
Worked example
A hospital already certified to ISO/IEC 27001 wants a PIMS for patient records and employee HR data. It should extend the ISMS scope rather than build a parallel system, map 27701 Clause 5 to its existing 27001 clauses, and apply Clause 7 and Annex A to patient and employee data as controller. For processing it performs for insurers as a processor, Clause 8 and Annex B also apply. A standalone set of privacy controls without the management-system clauses would not conform.
Traps that cost marks
Treating 27701 as a legal compliance certificate; confusing controller and processor; ignoring PII principals' rights; assuming PII is only digital; and forgetting that 27001 requirements continue to apply.