Planning a PIMS implementation based on ISO/IEC 27701
Domain 3 tests how to plan a PIMS: privacy risk assessment, risk treatment, Statement of Applicability, objectives, and resourcing. Planning converts initiation outputs into an auditable plan.
Core rules
- Identify and document PII processing activities: purposes, categories of PII and principals, recipients, transfers, retention, and systems.
- Assess privacy risks to PII principals and to the organisation. Consider likelihood and impact, legal and regulatory exposure, and harm such as discrimination, identity theft, or distress.
- Use documented risk criteria and a consistent method; integrate with the ISMS risk assessment but do not simply copy it.
- Select treatment options such as avoid, reduce, transfer, or accept; record residual risk and assign risk owners.
- Complete a DPIA or PIA where law or high risk requires it; use its results to drive controls.
- Produce a Statement of Applicability covering applicable 27701 Annex A/B/C controls with justification and implementation status.
- Set measurable PIMS objectives and plans: what, who, when, resources, and how results are evaluated.
Worked example
A retailer plans a PIMS for loyalty data, CCTV, and HR records. The risk assessment identifies excessive retention of loyalty data and broad vendor access. Treatment includes retention schedules, encryption, vendor clauses, and a DPIA for CCTV. The SoA marks Annex A controls applicable, excludes a processor-only control with justification, and records residual risk. Objectives include completing DPIAs for high-risk processing and reducing overdue PII requests. Owners and dates are assigned.
Traps that cost marks
Assessing only organisational risk and ignoring harm to PII principals; copying the ISMS risk register; treating DPIA as optional; omitting 27701 controls from the SoA; and setting objectives without metrics or owners.