ISO/IEC 27701 Foundation cheat sheet

Privacy is the interest of individuals in controlling how their personal information is collected, used, retained, and disclosed; data protection is the legal and organisational regime that safeguards that interest.

Personal data (GDPR) and personally identifiable information (ISO/IEC 29100) both denote information that can be linked to an identified or identifiable natural person; pseudonymised data remains personal data because re-identification is still possible.

Core privacy principles recurring across ISO/IEC 29100, ISO/IEC 27701 and GDPR Art. 5: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

ISO/IEC 29100 defines 11 privacy principles, including consent and choice, purpose legitimacy and specification, collection limitation, use/retention/disclosure limitation, accuracy and quality, openness/transparency/notice, individual participation and access, and accountability.

Data-protection roles: the PII principal (data subject) is the individual to whom PII relates; the PII controller determines the purposes and means of processing; the PII processor processes PII on behalf of and on the instructions of a controller.

A controller determines 'why and how'; a processor acts only on documented instructions. A party that goes beyond instructions or determines purposes itself becomes a controller for that processing.

Special categories of data (e.g. health, biometric, racial or ethnic origin, religious belief) and data about children attract stricter conditions and higher risk ratings in most privacy regimes.

Privacy harms are not limited to breaches: they include loss of autonomy, discrimination, re-identification, surveillance, and chilling effects, so risk assessment must consider impacts on individuals, not only on the organisation.

Privacy by design and by default requires embedding protections into the design of systems and processes and applying the most privacy-protective settings without user action.

ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management; it does not replace them, it adds PIMS-specific requirements and guidance on top of an ISMS.

The standard is structured as: Clauses 1-4 (scope, normative references, terms, general), Clause 5 (PIMS-specific requirements related to ISO/IEC 27001), Clause 6 (PIMS-specific guidance related to ISO/IEC 27002), Clause 7 (additional guidance for PII controllers), Clause 8 (additional guidance for PII processors), and Annexes A-F.

Clause 5 adds PIMS extensions to ISMS clauses 4-10, including privacy context, leadership and privacy policy, privacy risk assessment, and privacy performance evaluation; these are auditable requirements for PIMS certification.

Clause 6 extends the ISO/IEC 27002 control areas with PIMS-specific guidance mapped to the same 27002 structure (organisational, people, physical, technological controls).

Annex A lists PIMS-specific controls for PII controllers; Annex B lists PIMS-specific controls for PII processors; Annexes C and D map those controls back to ISO/IEC 27001/27002; Annexes E and F map to ISO/IEC 29100 privacy principles and to GDPR articles.

ISO/IEC 27701 was first published in 2019; a revised edition (2025) restructures the content to align with the 2022 editions of ISO/IEC 27001 and 27002, moving PII controller and processor guidance into the main body.

Scope is organisation-defined: the PIMS scope can cover the whole organisation or specific business units, systems, products or locations, but must sit within or alongside the ISMS scope and be documented.

Certification to ISO/IEC 27701 is only available as an extension to ISO/IEC 27001 certification; there is no standalone PIMS certification, and the ISMS must be in place first.

The standard is technology- and jurisdiction-neutral: it does not itself create legal compliance, but maps controls to obligations such as GDPR so they can be evidenced through the management system.

A PII controller determines the purposes and means of PII processing; under ISO/IEC 27701 it must establish a privacy policy, assign privacy roles and responsibilities, and integrate privacy into the ISMS.

Controller-specific controls in Annex A cover: conditions for collection and processing (lawful basis, consent, purpose), obligations to PII principals (notice, access, correction, erasure), privacy by design and by default, PII sharing, disclosure and transfer, and records of processing.

Consent-related controls require obtaining and recording consent, providing a mechanism to withdraw it, and ensuring consent is freely given, specific, informed and unambiguous where consent is the chosen basis.

PII principals' rights controls require providing notice of processing, enabling access, correction and erasure, and handling objections and complaints within stated timeframes.

Records of processing activities (ROPA) must capture purpose, categories of PII and principals, recipients, transfers to third countries, retention periods, and security measures.

PII sharing and transfer controls require due diligence on recipients, contractual terms, assessment of the legal environment in the destination country, and records of transfers.

Privacy by design and by default controls require limiting collection to what is necessary, pseudonymising or de-identifying where possible, and setting privacy-protective defaults in products and services.

Controllers must define and document retention schedules and ensure PII is deleted or anonymised when the purpose is fulfilled or the retention period expires.

Controller obligations include managing PII protection risk in supplier relationships, reviewing third-party processors, and maintaining audit logs of PII processing events.

A PII processor processes PII on behalf of, and only on the documented instructions of, a PII controller; processing for its own purposes makes it a controller for that activity.

Annex B controls for processors cover: customer agreement terms, processing instructions, organisational and technical measures, assistance to the controller, and return or deletion of PII at contract end.

Processors must ensure that personnel with access to PII are bound by confidentiality obligations and receive privacy awareness training.

Processors must maintain records of processing activities carried out on behalf of each controller, including categories of processing, transfers, and security measures.

Processors must assist controllers in responding to PII principal requests (access, correction, erasure) and in meeting breach notification and data protection impact assessment obligations.

Sub-contracting requires prior authorisation from the controller, flow-down of the same obligations to sub-processors, and a record of sub-processor engagements.

Processors must notify the controller without undue delay upon becoming aware of a PII breach, and must support the controller's incident investigation and remediation.

At the end of the contract, the processor must return or securely delete PII unless retention is required by law, and must provide evidence of deletion on request.

Processors must make available information necessary to demonstrate compliance and allow audits and inspections by the controller or an appointed auditor.

Privacy risk assessment identifies threats and vulnerabilities to PII, the likelihood and impact of privacy events on PII principals, and the resulting risk level; it is distinct from, but integrated with, information security risk assessment.

Impact is assessed on individuals (physical, material, non-material harm such as discrimination, reputational damage, financial loss) as well as on the organisation.

The risk treatment options are the same as in ISO/IEC 27001: modify (apply controls), retain (accept), avoid (stop the activity), and share (transfer to another party, e.g. via contract or insurance).

A data protection impact assessment (DPIA) is a structured privacy risk assessment for high-risk processing; ISO/IEC 27701 requires a documented process for determining when a DPIA is needed and for performing it.

The Statement of Applicability for a PIMS records which Annex A/B controls apply, why, and their implementation status; justified exclusions must be documented.

Controls are selected from ISO/IEC 27002 plus the PIMS-specific Annex A/B controls, and mapped to privacy principles (Annex E) and legal obligations (Annex F) for traceability.

Performance evaluation includes monitoring, measurement, internal audit and management review of the PIMS, with privacy-specific metrics such as request handling times and breach counts.

Nonconformity and corrective action follow the ISO/IEC 27001 clause 10 pattern: identify the nonconformity, determine the cause, implement action, review effectiveness, and update risk assessments if needed.

Continual improvement of the PIMS is driven by changes in law, technology, processing activities, audit findings, incidents, and management review outputs, with documented updates to risk treatment and controls.

Privacy is the interest of individuals in controlling how their personal information is collected, used, retained, and disclosed; data protection is the legal and organisational regime that safeguards that interest.

Personal data (GDPR) and personally identifiable information (ISO/IEC 29100) both denote information that can be linked to an identified or identifiable natural person; pseudonymised data remains personal data because re-identification is still possible.

Core privacy principles recurring across ISO/IEC 29100, ISO/IEC 27701 and GDPR Art. 5: lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability.

ISO/IEC 29100 defines 11 privacy principles, including consent and choice, purpose legitimacy and specification, collection limitation, use/retention/disclosure limitation, accuracy and quality, openness/transparency/notice, individual participation and access, and accountability.

Data-protection roles: the PII principal (data subject) is the individual to whom PII relates; the PII controller determines the purposes and means of processing; the PII processor processes PII on behalf of and on the instructions of a controller.

A controller determines 'why and how'; a processor acts only on documented instructions. A party that goes beyond instructions or determines purposes itself becomes a controller for that processing.

Special categories of data (e.g. health, biometric, racial or ethnic origin, religious belief) and data about children attract stricter conditions and higher risk ratings in most privacy regimes.

Privacy harms are not limited to breaches: they include loss of autonomy, discrimination, re-identification, surveillance, and chilling effects, so risk assessment must consider impacts on individuals, not only on the organisation.

Privacy by design and by default requires embedding protections into the design of systems and processes and applying the most privacy-protective settings without user action.

ISO/IEC 27701 is an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management; it does not replace them, it adds PIMS-specific requirements and guidance on top of an ISMS.

The standard is structured as: Clauses 1-4 (scope, normative references, terms, general), Clause 5 (PIMS-specific requirements related to ISO/IEC 27001), Clause 6 (PIMS-specific guidance related to ISO/IEC 27002), Clause 7 (additional guidance for PII controllers), Clause 8 (additional guidance for PII processors), and Annexes A-F.

Clause 5 adds PIMS extensions to ISMS clauses 4-10, including privacy context, leadership and privacy policy, privacy risk assessment, and privacy performance evaluation; these are auditable requirements for PIMS certification.

Clause 6 extends the ISO/IEC 27002 control areas with PIMS-specific guidance mapped to the same 27002 structure (organisational, people, physical, technological controls).

Annex A lists PIMS-specific controls for PII controllers; Annex B lists PIMS-specific controls for PII processors; Annexes C and D map those controls back to ISO/IEC 27001/27002; Annexes E and F map to ISO/IEC 29100 privacy principles and to GDPR articles.

ISO/IEC 27701 was first published in 2019; a revised edition (2025) restructures the content to align with the 2022 editions of ISO/IEC 27001 and 27002, moving PII controller and processor guidance into the main body.

Scope is organisation-defined: the PIMS scope can cover the whole organisation or specific business units, systems, products or locations, but must sit within or alongside the ISMS scope and be documented.

Certification to ISO/IEC 27701 is only available as an extension to ISO/IEC 27001 certification; there is no standalone PIMS certification, and the ISMS must be in place first.

The standard is technology- and jurisdiction-neutral: it does not itself create legal compliance, but maps controls to obligations such as GDPR so they can be evidenced through the management system.

A PII controller determines the purposes and means of PII processing; under ISO/IEC 27701 it must establish a privacy policy, assign privacy roles and responsibilities, and integrate privacy into the ISMS.

Controller-specific controls in Annex A cover: conditions for collection and processing (lawful basis, consent, purpose), obligations to PII principals (notice, access, correction, erasure), privacy by design and by default, PII sharing, disclosure and transfer, and records of processing.

Consent-related controls require obtaining and recording consent, providing a mechanism to withdraw it, and ensuring consent is freely given, specific, informed and unambiguous where consent is the chosen basis.

PII principals' rights controls require providing notice of processing, enabling access, correction and erasure, and handling objections and complaints within stated timeframes.

Records of processing activities (ROPA) must capture purpose, categories of PII and principals, recipients, transfers to third countries, retention periods, and security measures.

PII sharing and transfer controls require due diligence on recipients, contractual terms, assessment of the legal environment in the destination country, and records of transfers.

Privacy by design and by default controls require limiting collection to what is necessary, pseudonymising or de-identifying where possible, and setting privacy-protective defaults in products and services.

Controllers must define and document retention schedules and ensure PII is deleted or anonymised when the purpose is fulfilled or the retention period expires.

Controller obligations include managing PII protection risk in supplier relationships, reviewing third-party processors, and maintaining audit logs of PII processing events.

A PII processor processes PII on behalf of, and only on the documented instructions of, a PII controller; processing for its own purposes makes it a controller for that activity.

Annex B controls for processors cover: customer agreement terms, processing instructions, organisational and technical measures, assistance to the controller, and return or deletion of PII at contract end.

Processors must ensure that personnel with access to PII are bound by confidentiality obligations and receive privacy awareness training.

Processors must maintain records of processing activities carried out on behalf of each controller, including categories of processing, transfers, and security measures.

Processors must assist controllers in responding to PII principal requests (access, correction, erasure) and in meeting breach notification and data protection impact assessment obligations.

Sub-contracting requires prior authorisation from the controller, flow-down of the same obligations to sub-processors, and a record of sub-processor engagements.

Processors must notify the controller without undue delay upon becoming aware of a PII breach, and must support the controller's incident investigation and remediation.

At the end of the contract, the processor must return or securely delete PII unless retention is required by law, and must provide evidence of deletion on request.

Processors must make available information necessary to demonstrate compliance and allow audits and inspections by the controller or an appointed auditor.

Privacy risk assessment identifies threats and vulnerabilities to PII, the likelihood and impact of privacy events on PII principals, and the resulting risk level; it is distinct from, but integrated with, information security risk assessment.

Impact is assessed on individuals (physical, material, non-material harm such as discrimination, reputational damage, financial loss) as well as on the organisation.

The risk treatment options are the same as in ISO/IEC 27001: modify (apply controls), retain (accept), avoid (stop the activity), and share (transfer to another party, e.g. via contract or insurance).

A data protection impact assessment (DPIA) is a structured privacy risk assessment for high-risk processing; ISO/IEC 27701 requires a documented process for determining when a DPIA is needed and for performing it.

The Statement of Applicability for a PIMS records which Annex A/B controls apply, why, and their implementation status; justified exclusions must be documented.

Controls are selected from ISO/IEC 27002 plus the PIMS-specific Annex A/B controls, and mapped to privacy principles (Annex E) and legal obligations (Annex F) for traceability.

Performance evaluation includes monitoring, measurement, internal audit and management review of the PIMS, with privacy-specific metrics such as request handling times and breach counts.

Nonconformity and corrective action follow the ISO/IEC 27001 clause 10 pattern: identify the nonconformity, determine the cause, implement action, review effectiveness, and update risk assessments if needed.

Continual improvement of the PIMS is driven by changes in law, technology, processing activities, audit findings, incidents, and management review outputs, with documented updates to risk treatment and controls.