ISO 27701 LI study plan

Define PIMS, personally identifiable information (PII), PII principal, and PII controller versus PII processor in your own words without notes

Explain how ISO/IEC 27701 extends ISO/IEC 27001 and 27002 by mapping privacy controls onto an existing ISMS

Distinguish the controller role annex from the processor role annex and state which annex applies to which organization type

Summarize the privacy principles that underpin the standard: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability

Describe the structure of ISO/IEC 27701: clauses 4 to 8 for general requirements, clauses 5 and 6 for controllers, clauses 7 and 8 for processors, plus the annexes

Identify the inputs needed to start a PIMS: leadership mandate, scope boundary, applicable privacy legislation, existing ISMS artifacts

Draft a scope statement that names business units, products, locations, and systems in scope and explicitly lists exclusions

Map the organization's legal and regulatory obligations to the standard's control themes

Conduct a gap analysis against the ISO/IEC 27701 clauses and annex controls, rating each as absent, partial, or implemented

Perform a risk assessment that treats PII-specific risks (re-identification, unauthorized secondary use, excessive retention) alongside ISMS risks

Build a stakeholder and interested-party register covering data subjects, customers, regulators, and subprocessors

Draft the PIMS policy and objectives so they are consistent with the existing information security policy

Translate the gap analysis into a formal PIMS implementation plan with owners, dependencies, and target dates

Select and document the controls to apply, including justifications for any control from Annex A or B that is excluded

Establish the documented information required by the standard: policy, roles and responsibilities, records of processing, and PII principal request procedures

Define competence, awareness, and training requirements for staff who handle PII

Design PII processing records that capture purpose, categories of PII and principals, recipients, retention, and cross-border transfers

Write procedures for handling PII principal requests: access, correction, erasure, objection, and portability, including response timelines

Specify privacy by design and by default requirements to be embedded in project and change management processes

Define controls for engaging subprocessors, including due diligence, contractual terms, and flow-down obligations

Document incident and breach handling that links security incidents to privacy notification duties

Define monitoring, measurement, analysis, and evaluation activities with metrics that are specific and auditable

Set up internal audit planning that covers PII-specific controls, not just the underlying ISMS

Prepare a management review agenda that includes privacy performance, nonconformities, and changes in legal obligations

Design a method for tracking PII principal complaints and requests as a performance indicator

Run a tabletop internal audit of two or three privacy controls and record findings against the standard's requirements

Classify findings as conforming, observation, minor nonconformity, or major nonconformity with written rationale

Perform root cause analysis on at least two nonconformities and define corrective actions with effectiveness checks

Describe how continual improvement uses audit results, metrics trends, and management review outputs

Assemble the certification audit evidence pack: scope, SoA, policies, procedures, risk assessment, internal audit report, management review minutes

Prepare stage 1 and stage 2 expectations, including what auditors typically examine in each stage

Rehearse answers to likely auditor questions on controller/processor role determination, transfer mechanisms, and retention justification

Build a corrective action tracker that would satisfy an auditor reviewing continual improvement

Complete a timed practice assessment across all seven domains and review every missed item