Monitoring and measurement of a PIMS based on ISO/IEC 27701
Domain 5 tests performance evaluation: monitoring, measurement, analysis, internal audit, and management review for the PIMS.
Core rules
- Define what to monitor: PII processing changes, control effectiveness, PII requests, incidents and breaches, training, supplier performance, retention and deletion, and legal or regulatory changes.
- Specify method, frequency, owner, and criteria for each metric; analyse results rather than just collect data.
- Run an internal audit programme covering 27701 clauses and applicable annexes, not only 27001. Auditors should be objective and competent in privacy.
- Feed management review with PIMS-specific inputs: audit results, incidents, risks, legal changes, objectives, interested-party feedback, and resource needs.
- Record decisions and actions, including changes to risk treatment and the SoA.
- Escalate significant privacy risks and nonconformities through the management system.
Worked example
A company tracks monthly: percentage of PII requests closed on time, privacy incidents, suppliers with privacy clauses, and training completion. Internal audit samples request logs and finds three late responses. Management review reviews the trend, decides to automate intake, assigns an owner, and sets a target. The next monitoring cycle checks effectiveness.
Traps that cost marks
Monitoring only ISMS metrics; collecting data without analysis; internal audit excluding 27701 annex controls; management review without decisions; and failing to monitor regulatory change.