Implementation of a PIMS based on ISO/IEC 27701
Domain 4 tests whether you can operationalise the PIMS: controls, documented information, competence, communication, incident handling, PII requests, suppliers, and records.
Core rules
- Implement applicable Annex A/B/C controls and the Clause 7 and 8 guidance; update the SoA as implementation progresses.
- Maintain documented information required by the PIMS and by law: policies, procedures, records of processing, risk assessments, DPIAs, training records, incident logs, and supplier assessments.
- Assign competence and awareness: staff handling PII need role-specific training, not only generic security awareness.
- Operate PII principal request handling: intake, identity verification, routing, response within required timelines, and records.
- Manage privacy incidents and breaches: detect, contain, assess, notify controllers, regulators, or PII principals where required, and learn from the event.
- Manage suppliers and transfers: due diligence, contracts, monitoring, and flow-down of obligations.
- Apply privacy by design and by default in projects and changes; maintain retention and deletion.
Worked example
A payroll processor receives an access request from a controller. It verifies the request, checks the contractual response time, retrieves the data, responds through the agreed channel, and logs the request. For a suspected breach, it notifies the controller within the contractual window, provides facts and remediation, and records the incident. Evidence includes the procedure, ticket records, contract clauses, and training completion.
Traps that cost marks
Writing policies without operating evidence; confusing controller and processor duties; quoting a universal 72-hour breach deadline when it is jurisdiction-specific; missing records; and failing to update the SoA.