ISO/IEC 27701 Foundation key terms

A documented management system that establishes privacy policy, objectives, and processes for handling personally identifiable information, built so it can be integrated with an existing information security management system.

The international standard that extends ISO/IEC 27001 and ISO/IEC 27002 with requirements and guidance for protecting privacy, organized around PII controller and PII processor roles.

The design approach in which ISO/IEC 27701 adds privacy-specific requirements and guidance on top of the information security management system clauses and controls, rather than creating a separate standalone standard.

The part of ISO/IEC 27701 containing additional control objectives and controls for privacy, mapped to ISO/IEC 27002 control areas and aligned with the standard's management system clauses.

The section of ISO/IEC 27701 that gives guidance to organizations acting as PII controllers, covering how to apply the privacy controls to their own processing activities and obligations.

The section of ISO/IEC 27701 that gives guidance to organizations acting as PII processors, addressing controls for processing PII on behalf of a controller and for supporting the controller's obligations.

Any information that can identify an individual, directly or indirectly, when combined with other data or used in a particular context, including identifiers, contact details, and behavioral records.

The individual to whom personally identifiable information relates; the person whose privacy interests the management system is designed to protect and whose rights the organization must support.

The organization or body that determines the purposes and means of processing personally identifiable information, and therefore carries primary responsibility for compliance with privacy obligations.

An organization that processes personally identifiable information on behalf of a PII controller, acting on the controller's documented instructions and typically bound by a contract.

Two or more organizations that jointly determine the purposes and means of processing, so that both share controller responsibilities for the processing concerned.

A contract or equivalent arrangement that sets out how a processor may handle PII for a controller, including instructions, confidentiality, security measures, sub-processing, and return or deletion of data.

A third party engaged by a PII processor to carry out part of the processing, which requires controller authorization and equivalent contractual privacy and security obligations.

The entitlements of individuals over their PII, such as access, correction, erasure, restriction, objection, and portability, which the organization must be able to fulfill on request.

A lawful basis for processing where the individual freely gives specific, informed agreement to the processing of their PII, which must be recorded and can be withdrawn.

The legal ground that justifies processing PII, such as consent, contract, legal obligation, vital interest, public task, or legitimate interest, which must be identified and documented.

The principle that the reasons for collecting PII must be defined, documented, and communicated before processing begins, and that later use must remain compatible with those stated purposes.

The rule that PII may only be used for the purposes for which it was collected or for purposes that are compatible with them, preventing unrestricted reuse of personal data.

The principle of collecting and processing only the PII that is adequate, relevant, and necessary for the stated purpose, and keeping it no longer than required.

The principle that PII should be retained only for as long as needed for its purpose or as legally required, after which it must be deleted or irreversibly anonymized.

The principle that PII should be correct, complete, and kept up to date as necessary for its purpose, with reasonable steps taken to correct or erase inaccurate data.

The obligation to be able to demonstrate that privacy obligations are met, through documented policies, records, risk assessments, training, and evidence available for review.

An approach in which privacy protections are built into systems, processes, and products from the outset rather than added afterwards, including default settings that limit data collection and exposure.

The practice of configuring systems and services so that, without user action, only the minimum PII needed for a given purpose is collected, used, and made visible.

A public statement explaining what PII is collected, why, how it is used and shared, how long it is kept, and how individuals can exercise their rights.

The principle that organizations communicate clearly and openly about their PII processing practices, so individuals can understand and make informed choices about their data.

A structured process for identifying privacy risks to individuals arising from PII processing, estimating their likelihood and impact, and selecting controls to reduce them.

A targeted assessment performed for a specific project, system, or processing activity that is likely to create high privacy risk, documenting impacts on individuals and mitigating measures.

The defined scales and thresholds an organization uses to judge the significance of privacy risks, including how likelihood and impact on individuals are rated and which risks are unacceptable.

A documented plan describing which privacy risk treatment options are chosen, the controls to be implemented, responsible owners, resources, and target dates for completion.

A document listing the privacy and security controls relevant to the organization, stating whether each is applied or excluded, and giving the justification for that decision.

An inventory describing each processing activity, its purposes, categories of PII and individuals, recipients, transfers, retention periods, and the security measures applied to it.

The practice of charting how PII moves between systems, teams, and third parties, from collection through storage and sharing to disposal, to reveal where privacy risk arises.

The movement of PII to another organization, location, or country, which requires a lawful basis, appropriate safeguards, and documented arrangements with the recipient.

A technique that reduces the link between PII and the individual, such as pseudonymization or anonymization, lowering privacy risk while preserving some analytical usefulness.

Replacing direct identifiers with codes so that PII can no longer be attributed to an individual without additional separately held information, while still permitting re-identification when needed.

An event that compromises the confidentiality, integrity, or availability of PII, or that breaches privacy obligations, requiring containment, assessment, and notification where appropriate.

The obligation to inform affected individuals, controllers, or regulators about a PII breach within defined timeframes when it is likely to result in significant harm or risk.

The documented process for detecting, containing, investigating, and recovering from privacy incidents, including roles, escalation paths, evidence retention, and lessons learned.

The ongoing cycle of measuring privacy performance, auditing, correcting nonconformities, and adjusting controls so the management system remains effective over time.

The documented links showing how ISO/IEC 27701 privacy controls relate to ISO/IEC 27001 and ISO/IEC 27002 requirements, helping organizations reuse existing security work.