ISO/IEC 27701 Foundation flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

PII principal

The individual to whom personally identifiable information relates, also called the data subject. ISO/IEC 27701 uses this term to keep the standard neutral across jurisdictions and legal regimes.

PII controller

The entity that alone or jointly with others determines the purposes and means of processing PII. It carries primary accountability for lawful processing and for responding to PII principal requests.

PII processor

An entity that processes PII on behalf of a PII controller and only on the controller's documented instructions. Processing beyond those instructions may make it a controller for that activity.

Data minimisation

A privacy principle requiring collection and use of only the PII that is adequate, relevant and necessary for the stated purpose. It reduces both privacy risk and the scope of protection obligations.

Purpose limitation

The principle that PII is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. It anchors notice, consent and retention decisions.

Pseudonymisation

Replacing identifying attributes with artificial identifiers so PII cannot be attributed to a principal without additional information kept separately. Pseudonymised data remains personal data under most regimes.

Privacy by design

Embedding privacy protections into system architecture, processes and business practices from the outset rather than adding them afterwards. It is a controller obligation reflected in ISO/IEC 27701 controls.

Privacy by default

Configuring products and services so that only the minimum PII necessary for the chosen purpose is processed without the principal having to change settings. It complements privacy by design.

ISO/IEC 29100 privacy principles

Eleven internationally recognised privacy principles covering consent and choice, purpose legitimacy, collection limitation, use limitation, accuracy, openness, individual participation and accountability. ISO/IEC 27701 Annex E maps its controls to them.

Relationship to ISO/IEC 27001

ISO/IEC 27701 is an extension to ISO/IEC 27001, not a replacement. It adds PIMS-specific requirements to the ISMS clauses and cannot be certified without an underlying ISO/IEC 27001 ISMS.

Clause 5 of ISO/IEC 27701

The clause containing PIMS-specific requirements that extend ISO/IEC 27001 clauses 4 to 10. It covers privacy context, leadership, planning, support, operation, performance evaluation and improvement.

Clause 6 of ISO/IEC 27701

The clause providing PIMS-specific guidance that extends ISO/IEC 27002 control guidance. It follows the same control-area structure so it can be read alongside the security controls.

Annex A and Annex B

Annex A lists PIMS-specific controls and guidance for PII controllers; Annex B lists them for PII processors. Together they form the privacy control catalogue added on top of ISO/IEC 27002.

Annex C and Annex D

Annexes that map the PII controller (Annex A) and PII processor (Annex B) controls to the corresponding ISO/IEC 27001 and ISO/IEC 27002 clauses and controls.

Annex E and Annex F

Annex E maps ISO/IEC 27701 controls to the ISO/IEC 29100 privacy principles; Annex F maps them to GDPR articles. They support traceability between controls, principles and legal obligations.

PIMS scope definition

The documented boundary of the privacy information management system, covering business units, locations, systems and processing activities. It must be consistent with and normally sits within the ISMS scope.

Clause 7 and Clause 8

Clause 7 gives additional guidance for PII controllers and Clause 8 for PII processors in the 2019 edition. The 2025 revision relocates this guidance into the main body.

Records of processing activities

A controller or processor record describing purposes, categories of PII and principals, recipients, transfers, retention periods and security measures. It is a core Annex A and Annex B control.

Consent controls for controllers

Controls requiring consent to be freely given, specific, informed and unambiguous, recorded as evidence, and withdrawable through an accessible mechanism. Withdrawal must be as easy as giving consent.

PII principal access requests

Controller obligations to provide notice, enable access, correction, erasure and objection, and handle complaints within defined timeframes. Processes and logs must evidence each request and response.

PII disclosure and transfer controls

Controls requiring due diligence on recipients, contractual safeguards, assessment of destination-country legal environment, and records of transfers. They apply to third parties and cross-border transfers.

Retention schedule

A documented rule set stating how long each category of PII is kept and how it is deleted or anonymised afterwards. It operationalises the storage limitation principle.

Controller privacy policy

A top-level document stating the organisation's privacy commitments, principles, roles and responsibilities. It is approved by top management and integrated with the overall information security policy.

Processor instructions

Documented directions from the controller defining what PII the processor may handle, for which purposes, and under which constraints. Processing outside these instructions is not permitted.

Processor confidentiality obligations

A requirement that personnel authorised to access PII are bound by confidentiality commitments and receive privacy training. Access should be limited to those who need it for the instructed processing.

Sub-processor authorisation

A processor may engage a sub-processor only with the controller's prior authorisation and must flow down equivalent obligations. A record of sub-processors and their scope must be maintained.

Breach notification by processors

Processors must notify the controller without undue delay after becoming aware of a PII breach and provide information needed for the controller's own notification and remediation duties.

Return or deletion at contract end

A processor obligation to return or securely delete PII when processing ends, unless law requires retention. Evidence of deletion must be available to the controller on request.

Processor audit rights

A processor must allow audits and inspections by the controller or an appointed auditor and make available information demonstrating compliance with the agreed PII protection measures.

Privacy risk assessment

A process identifying threats and vulnerabilities to PII and estimating likelihood and impact of privacy events on PII principals. It is integrated with, but distinct from, information security risk assessment.

Data protection impact assessment

A structured assessment required for high-risk processing, describing the processing, assessing necessity and risks to principals, and defining mitigating measures. ISO/IEC 27701 requires a documented DPIA process.

PIMS Statement of Applicability

A document listing applicable Annex A and Annex B controls, the justification for inclusion or exclusion, and implementation status. It provides the control baseline for PIMS audits and certification.

PIMS continual improvement

Ongoing enhancement driven by legal change, new technology, incidents, audit findings and management review. Outputs update risk assessments, controls and the Statement of Applicability.