Continual improvement of a PIMS based on ISO/IEC 27701
Domain 6 tests nonconformity, corrective action, and continual improvement of the PIMS.
Core rules
- Distinguish correction, which fixes the immediate issue, from corrective action, which removes the cause.
- Record nonconformities from audits, incidents, requests, supplier issues, and monitoring; assess impact on PII and the PIMS.
- Perform root-cause analysis proportionate to the issue; plan action, assign owner and date, and check effectiveness.
- Update risk assessment, risk treatment, SoA, procedures, and training when changes occur.
- Use management review, internal audit, incidents, legal changes, and technology changes as improvement inputs.
- Maintain evidence of implementation and effectiveness; close actions only after verification.
Worked example
Repeated late PII requests are logged as a nonconformity. Correction: apologise and respond. Root cause: no workflow and unclear ownership. Corrective action: implement a request workflow, assign a coordinator, train staff, and add an SLA metric. An effectiveness check after two months shows on-time performance improved. The procedure and risk assessment are updated.
Traps that cost marks
Treating correction as corrective action; no root cause; no effectiveness check; not updating the SoA or risk assessment; and ignoring changes in law or processing.