ISO/IEC 27701 Foundation case studies
ISO/IEC 27701 Foundation · Put your knowledge to work in context.
The ISO/IEC 27701 Foundation credential is an entry-level privacy certification offered through PECB's Privacy and Data Protection training category, alongside its GDPR course. It is aimed at candidates who need a working vocabulary of privacy information management rather than hands-on implementation depth: newcomers to privacy programmes, IT and security staff whose duties now touch personal data, auditors and consultants building awareness, and managers who support a privacy information management system (PIMS) without running it. The ISO/IEC 27701 Foundation case studies are 5 cases and about 4,287 words.
1PulseCheck: the 'it's only aggregate' claim
Helio Systems runs a 1,800-person workforce across Germany, Poland and Ireland and licenses a wellness app called PulseCheck from an external vendor. Enrollment is voluntary and 214 employees have signed up.
874 words, about 4 min2Nordwind: bolting a PIMS onto an existing 27001 certificate
Nordwind Logistics has held ISO/IEC 27001 certification since 2021. Its certification scope reads: 'Freight booking platform and supporting infrastructure operated from the Gdańsk headquarters and two data centres.' Customers now send privacy questionnaires, so the CISO wants 27701 added before the next surveillance audit.
866 words, about 4 min3Loyalty programme: pre-ticked consent, partner sharing and an erasure request
A European grocery chain runs a loyalty programme with 2.4 million members. Until 2023 the sign-up screen carried a pre-ticked box agreeing to 'marketing from the group and selected partners', and that box was the only route to joining.
828 words, about 4 min4CloudTick: a processor with a discretionary sub-processor clause
CloudTick provides ticketing software to 140 event organisers, all based in the EU. Its data processing agreement states that CloudTick 'may engage sub-processors at its discretion'.
866 words, about 4 min5An insurer scoring privacy risk for the company instead of for people
An insurer has 300 documented PII processing activities. Its privacy risk assessment scores each one as likelihood (1-5) multiplied by financial impact on the company (1-5), with anything at 12 or above treated as high.
853 words, about 4 min