I85PREP
⌘ K
ISO/IEC 27701 Foundation study materials
ISO/IEC 27701 Foundation study resources

ISO/IEC 27701 Foundation practice questions

One question at a time. Build your ISO/IEC 27701 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental concepts and principles of privacy and data protection

In privacy terminology, what does the term 'personal data' refer to?

  1. Any information stored in an electronic database owned by an organization
  2. Any information relating to an identified or identifiable natural person Correct answer.
  3. Only information that a person has explicitly declared confidential
  4. Aggregated statistics that cannot be linked to any individual

Explanation

Personal data is defined by its relationship to a person: information relating to an identified or identifiable natural person. The concept does not depend on storage medium or on any declaration of confidentiality by the individual.

Question 2Fundamental concepts and principles of privacy and data protection

Which term describes the natural or legal person, public authority, or body that determines the purposes and means of processing personal data?

  1. Supervisory authority
  2. Data subject
  3. Controller Correct answer.
  4. Processor

Explanation

The controller is the entity that decides why and how personal data is processed. The processor acts on the controller's behalf, while the data subject is the individual and the supervisory authority is a regulator.

Question 3Fundamental concepts and principles of privacy and data protection

What is the primary role of a privacy impact assessment within a privacy management system?

  1. To identify and mitigate privacy risks of a processing activity before it is carried out Correct answer.
  2. To certify that an organization's products meet a national security standard
  3. To calculate the financial penalties an organization might receive
  4. To replace the need for a record of processing activities

Explanation

A privacy impact assessment is a forward-looking risk tool: it examines a planned processing activity, identifies privacy risks, and defines mitigations. It supports decision-making and does not replace operational records or serve as a certification.

Question 4Fundamental concepts and principles of privacy and data protection

Which statement best captures the principle of purpose limitation?

  1. Personal data must always be deleted immediately after the first use
  2. Personal data should be collected in the largest volume that the technology allows
  3. Personal data may be used for any purpose once the individual has been informed
  4. Personal data should be collected for specified, explicit, and legitimate purposes and not further processed incompatibly Correct answer.

Explanation

Purpose limitation requires that purposes be specified, explicit, and legitimate at collection, and that later processing remain compatible with them. Informing the individual does not by itself authorize unrelated reuse.

Question 5Fundamental concepts and principles of privacy and data protection

The principle of data minimization primarily requires that an organization:

  1. Obtains a separate written consent for each individual data field
  2. Stores personal data only on servers located within one country
  3. Collects only personal data that is adequate, relevant, and limited to what is necessary Correct answer.
  4. Retains all personal data for the maximum period permitted by law

Explanation

Data minimization ties collection to necessity: data must be adequate, relevant, and limited to what the stated purpose requires. It addresses volume and scope of data, not server location or per-field consent formalities.

Question 6Fundamental concepts and principles of privacy and data protection

Under a typical privacy framework, which of the following is an example of a data subject right?

  1. The right to set the controller's retention schedule
  2. The right to approve the controller's marketing budget
  3. The right to audit the controller's internal network
  4. The right to obtain confirmation of whether personal data concerning them is being processed Correct answer.

Explanation

Data subject rights focus on the individual's relationship to their own data, such as access, rectification, erasure, and confirmation of processing. Internal network auditing and corporate governance decisions lie outside that scope.

Question 7Fundamental concepts and principles of privacy and data protection

What distinguishes a processor from a controller in a processing relationship?

  1. The processor processes personal data on behalf of, and on the instructions of, the controller Correct answer.
  2. The processor always owns the personal data it handles
  3. The processor determines the lawful basis for the processing
  4. The processor is always a public authority

Explanation

A processor handles personal data on behalf of the controller and follows the controller's documented instructions. The controller retains authority over purposes and lawful basis, and ownership of data is not transferred to the processor.

Question 8Fundamental concepts and principles of privacy and data protection

Which concept refers to information that does not relate to an identified or identifiable natural person?

  1. Metadata
  2. Anonymous data Correct answer.
  3. Special category data
  4. Pseudonymized data

Explanation

Anonymous data cannot be linked to an identified or identifiable person, so it falls outside the scope of personal data. Pseudonymized data can still be re-linked and therefore remains personal data.

Question 9Fundamental concepts and principles of privacy and data protection

A retailer collects customer email addresses to send order confirmations, then begins using the same addresses for unrelated third-party advertising without any new basis. Which principle is most directly engaged?

  1. Accuracy
  2. Purpose limitation Correct answer.
  3. Storage limitation
  4. Integrity and confidentiality

Explanation

Reusing data for an unrelated purpose that was not specified at collection engages purpose limitation. Compatibility of the new purpose with the original one must be assessed, and a lawful basis for the new use is needed.

Question 10Fundamental concepts and principles of privacy and data protection

An organization encrypts personal data at rest and applies role-based access control. Which privacy principle does this most directly support?

  1. Integrity and confidentiality Correct answer.
  2. Accuracy
  3. Purpose limitation
  4. Accountability

Explanation

Encryption and access control are technical measures that protect data against unauthorized access and alteration, which is the integrity and confidentiality principle. Accountability concerns demonstrating compliance, not the security measure itself.

Question 11Fundamental concepts and principles of privacy and data protection

What does the accountability principle require of an organization processing personal data?

  1. That it delegates all privacy decisions to its customers
  2. That it is able to demonstrate compliance with applicable privacy requirements Correct answer.
  3. That it publishes every individual's personal data to prove transparency
  4. That it avoids keeping any records about its processing

Explanation

Accountability means the organization is responsible for compliance and must be able to demonstrate it, for example through policies, records, and assessments. It does not require disclosure of personal data or avoidance of records.

Question 12Fundamental concepts and principles of privacy and data protection

Which of the following best describes 'special categories of personal data'?

  1. Data collected only from public authorities
  2. Sensitive data such as health, biometric, or ethnic origin information that warrants extra protection Correct answer.
  3. Data that is stored in a special encrypted format
  4. Any data that a company classifies as confidential for commercial reasons

Explanation

Special categories cover sensitive types of data, such as health, biometric, genetic, or ethnic origin information, which generally require additional safeguards or specific conditions for processing. The classification is about the nature of the data, not its format or source.

Question 13Fundamental concepts and principles of privacy and data protection

A company transfers personal data to a service provider that will process it only for payroll administration. Who should be regarded as the controller for that payroll data?

  1. The supervisory authority, because it oversees payroll
  2. The service provider, because it performs the processing
  3. The employees, because the data belongs to them
  4. The company, because it determines why and how the data is processed Correct answer.

Explanation

The company decides the purpose (payroll administration) and the means, so it acts as controller. The service provider processes on the company's instructions and is therefore a processor.

Question 14Fundamental concepts and principles of privacy and data protection

Which statement correctly distinguishes privacy from data protection?

  1. Privacy applies only to companies, while data protection applies only to individuals
  2. Data protection concerns only physical security of paper documents
  3. Privacy is a broader concept about the individual's sphere of autonomy, while data protection focuses on safeguarding personal data during processing Correct answer.
  4. Privacy and data protection are identical terms with no meaningful distinction

Explanation

Privacy is the wider notion of personal autonomy and control over one's sphere, while data protection is the specific set of rules and safeguards for processing personal data. Treating them as identical obscures this relationship.

Question 15Fundamental concepts and principles of privacy and data protection

What is the main purpose of maintaining a record of processing activities?

  1. To serve as a marketing list of customers
  2. To provide an overview of what personal data is processed, why, and by whom, supporting accountability Correct answer.
  3. To eliminate the need for any privacy training
  4. To replace the organization's information security policy

Explanation

Records of processing activities document the purposes, categories of data, recipients, and retention, giving an overview that supports accountability and oversight. They complement, rather than replace, security policies and training.

Question 16Fundamental concepts and principles of privacy and data protection

Which of the following best illustrates the principle of storage limitation?

  1. Defining retention periods and deleting or anonymizing data once they expire Correct answer.
  2. Keeping customer data indefinitely in case it might be useful later
  3. Backing up all data to multiple locations for resilience
  4. Encrypting all data so it can be stored without time limits

Explanation

Storage limitation requires that personal data be kept no longer than necessary for the purpose, which is implemented through defined retention periods and deletion or anonymization. Encryption or backups do not remove the time limit.

Question 17Fundamental concepts and principles of privacy and data protection

A privacy framework typically requires that personal data be accurate and, where necessary, kept up to date. Which principle does this reflect?

  1. Data minimization
  2. Accuracy Correct answer.
  3. Transparency
  4. Accountability

Explanation

The accuracy principle requires personal data to be correct and updated where necessary, and inaccurate data to be rectified or erased. Transparency, minimization, and accountability address different obligations.

Question 18Fundamental concepts and principles of privacy and data protection

Which scenario most clearly involves pseudonymized rather than anonymous data?

  1. Aggregated sales totals with no individual records
  2. Data collected from volunteers who are told they cannot be identified
  3. Records where direct identifiers are replaced by codes, but a separately secured key allows re-identification Correct answer.
  4. Statistical results rounded so that no individual can be singled out

Explanation

Pseudonymization replaces identifiers with codes while keeping a key that allows re-identification, so the data remains personal data. Truly anonymous data cannot be linked back to individuals even with additional information.

Question 19Fundamental concepts and principles of privacy and data protection

What does the transparency principle generally require of an organization?

  1. That it hides its privacy practices to protect trade secrets
  2. That it provides clear information about how personal data is processed and the rights available Correct answer.
  3. That it discloses all personal data to the public
  4. That it processes data only in secret to avoid scrutiny

Explanation

Transparency requires clear, accessible information about processing purposes, lawful basis, recipients, and data subject rights. It does not mean publishing personal data or concealing practices.

Question 20Fundamental concepts and principles of privacy and data protection

An organization wants to rely on consent as a lawful basis. Which condition is most consistent with valid consent under privacy frameworks?

  1. Consent obtained through a pre-ticked box that users rarely notice
  2. Consent that is freely given, specific, informed, and unambiguous Correct answer.
  3. Consent implied from the fact that a person visited a website
  4. Consent bundled with unrelated terms that cannot be refused

Explanation

Valid consent must be freely given, specific, informed, and unambiguous, expressed by a clear affirmative action. Pre-ticked boxes, mere website visits, and bundled non-negotiable terms generally fail these conditions.

Question 21Fundamental concepts and principles of privacy and data protection

A controller engages a cloud provider that stores personal data but makes no decisions about its use. How should the cloud provider be characterized?

  1. As a processor, because it acts on the controller's instructions Correct answer.
  2. As a joint controller, because storage is a processing activity
  3. As a data subject, because it holds the data
  4. As a controller, because it stores the data

Explanation

A provider that stores data without deciding purposes or means acts as a processor on the controller's instructions. Storage is a processing operation, but performing it does not confer controllership.

Question 22Fundamental concepts and principles of privacy and data protection

Which principle is most directly associated with the requirement to consider privacy throughout the design of systems and processes?

  1. Privacy by design and by default Correct answer.
  2. Freedom of information
  3. Storage limitation
  4. Data accuracy

Explanation

Privacy by design and by default requires that privacy safeguards be embedded into systems and processes from the outset and be active without user intervention. The other principles address retention, correctness, or access to public information.

Question 23Fundamental concepts and principles of privacy and data protection

Why does pseudonymized data generally remain within the scope of data protection rules?

  1. Because pseudonymization increases the volume of data collected
  2. Because pseudonymization is prohibited by privacy frameworks
  3. Because pseudonymized data is always stored in paper form
  4. Because additional information can still attribute the data to an individual, making the person identifiable Correct answer.

Explanation

Pseudonymized data can be attributed to a person when the additional information (such as a key) is available, so the individual remains identifiable and the data stays personal. Only when re-identification is genuinely impossible does anonymization apply.

Question 24Fundamental concepts and principles of privacy and data protection

A controller wishes to use data collected for warranty registration to build a marketing profile. Which analysis best reflects privacy principles?

  1. The new use is prohibited in all circumstances regardless of safeguards
  2. The new use is automatically permitted because the data was lawfully collected
  3. The new use is permitted only if the data is deleted first and then re-collected
  4. Compatibility of the new purpose with the original purpose should be assessed, and a lawful basis for marketing identified Correct answer.

Explanation

Purpose limitation requires assessing whether the new purpose is compatible with the original one and identifying an appropriate lawful basis, such as consent where required. Lawful collection for one purpose does not automatically authorize unrelated reuse.

Question 25Fundamental concepts and principles of privacy and data protection

Which pair of concepts is correctly contrasted?

  1. Anonymization keeps a key for re-identification, whereas pseudonymization destroys all identifiers
  2. Both anonymization and pseudonymization guarantee that data is no longer personal data
  3. Anonymization removes identifiability permanently, whereas pseudonymization keeps a means of re-identification Correct answer.
  4. Pseudonymization is a legal basis, whereas anonymization is a data subject right

Explanation

Anonymization aims to make re-identification impossible so the data falls outside personal data rules, while pseudonymization replaces identifiers but retains a re-identification mechanism. Neither is a lawful basis or a data subject right.

Question 26Fundamental concepts and principles of privacy and data protection

In privacy terminology, what is the primary distinction between 'personal data' and 'personal information' as used in different jurisdictions?

  1. Personal data refers only to digital records, while personal information includes paper records.
  2. The terms are generally equivalent, though 'personal data' is more common in EU instruments and 'personal information' in many other jurisdictions. Correct answer.
  3. Personal data is a term used exclusively in the GDPR, while personal information is used only in the US.
  4. Personal data refers to data about individuals, while personal information refers to data about households.

Explanation

Both terms refer to information relating to an identified or identifiable natural person. The choice between them is largely a matter of legal tradition rather than substantive scope. ISO/IEC 27701 uses 'personally identifiable information (PII)' as its core term, which encompasses both concepts.

Question 27Fundamental concepts and principles of privacy and data protection

Under the GDPR, which of the following is a lawful basis for processing personal data that does not require the data subject's consent?

  1. Legitimate interest of the data subject
  2. Compliance with a non-binding industry code
  3. Performance of a contract with the data subject Correct answer.
  4. Explicit consent

Explanation

The GDPR recognizes several lawful bases besides consent, including performance of a contract, legal obligation, vital interests, public task, and legitimate interests. Processing is lawful if at least one basis applies. Contract performance is independent of consent.

Question 28Fundamental concepts and principles of privacy and data protection

Which statement best describes the role of a privacy notice (sometimes called a privacy policy) in data protection?

  1. It transfers ownership of personal data to the organization.
  2. It is a public statement that informs individuals about how their personal data is collected, used, and shared. Correct answer.
  3. It is a contract that binds the data subject to the organization's terms.
  4. It is an internal document that is not intended for external audiences.

Explanation

A privacy notice is a transparency tool that explains an organization's data processing practices to individuals. It supports the principle of transparency and helps individuals understand their rights. It is not a contract and does not transfer ownership.

Question 29Fundamental concepts and principles of privacy and data protection

What is the main purpose of a data protection impact assessment (DPIA) under privacy regulations such as the GDPR?

  1. To identify and mitigate high risks to individuals' rights and freedoms arising from processing. Correct answer.
  2. To obtain consent from data subjects before processing begins.
  3. To calculate the financial cost of a data breach.
  4. To certify that an organization is fully compliant with all privacy laws.

Explanation

A DPIA is a process for identifying and reducing privacy risks, especially for high-risk processing. It helps organizations design processing in a privacy-protective way. It is not a certification or a consent mechanism.

Question 30Fundamental concepts and principles of privacy and data protection

An organization collects personal data for a specified purpose and later wants to use it for a new, compatible purpose. According to the purpose limitation principle, what must the organization typically do?

  1. Nothing, because purpose limitation only applies to sensitive data.
  2. Obtain fresh consent in all cases, regardless of compatibility.
  3. Delete the data and recollect it for the new purpose.
  4. Assess whether the new purpose is compatible with the original purpose and inform data subjects if required. Correct answer.

Explanation

Purpose limitation requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing for a compatible purpose may be allowed, often with additional safeguards or transparency. It is not limited to sensitive data, and consent is not always required.

Question 31Fundamental concepts and principles of privacy and data protection

Which of the following best illustrates the principle of data minimization?

  1. Collecting as much data as possible in case it becomes useful later.
  2. Collecting only the data elements necessary to fulfill a specified purpose. Correct answer.
  3. Sharing data with all departments to maximize its utility.
  4. Retaining all collected data for the maximum period allowed by law.

Explanation

Data minimization means limiting the collection of personal data to what is adequate, relevant, and necessary for the intended purpose. It reduces privacy risk and supports other principles like storage limitation. Collecting extra data 'just in case' contradicts this principle.

Question 32Fundamental concepts and principles of privacy and data protection

A company processes personal data of employees for payroll and also for marketing its products to them. Which statement best reflects the privacy principle of purpose specification?

  1. Both purposes are acceptable because the company has a legitimate interest in marketing.
  2. The marketing purpose must be specified and assessed for compatibility with the payroll purpose, and may require a separate lawful basis. Correct answer.
  3. Purpose specification only applies to data collected from third parties.
  4. Payroll and marketing are always compatible because both benefit the employee.

Explanation

Purpose specification requires that purposes be defined and documented at the time of collection. Using employee data for marketing is a new purpose that must be assessed for compatibility with the original payroll purpose and may need its own lawful basis, such as consent or legitimate interests. It is not automatically acceptable.

Question 33Fundamental concepts and principles of privacy and data protection

Under the GDPR, which of the following is a key requirement for obtaining valid consent?

  1. Consent must be implied from the data subject's silence.
  2. Consent must be obtained in writing and signed by the data subject.
  3. Consent must be obtained only for sensitive data.
  4. Consent must be freely given, specific, informed, and unambiguous. Correct answer.

Explanation

Valid consent under the GDPR must be freely given, specific, informed, and unambiguous, and indicated by a clear affirmative action. It does not need to be written or signed in all cases. Silence or inactivity does not constitute consent.

Question 34Fundamental concepts and principles of privacy and data protection

Which of the following best describes the role of a Data Protection Officer (DPO) under the GDPR?

  1. To independently monitor compliance with data protection laws and advise on obligations. Correct answer.
  2. To act as the sole decision-maker for all processing activities.
  3. To represent data subjects in legal disputes against the controller.
  4. To market the organization's privacy certifications.

Explanation

The DPO's role is to inform and advise the organization, monitor compliance, and cooperate with supervisory authorities. The DPO should act independently and not be instructed on how to perform their tasks. They do not make all processing decisions or represent data subjects in disputes.

Question 35Fundamental concepts and principles of privacy and data protection

A hospital shares patient data with a research institute for a study. The hospital remains responsible for the data and determines the purposes of processing. What is the hospital's role under the GDPR?

  1. Data subject
  2. Processor
  3. Controller Correct answer.
  4. Supervisory authority

Explanation

The controller determines the purposes and means of processing personal data. The hospital decides why and how patient data is used, even when sharing with a research institute, so it acts as a controller. The research institute may be a processor or a separate controller depending on its role.

Question 36Fundamental concepts and principles of privacy and data protection

Which of the following is an example of a privacy-enhancing technology (PET) that supports data protection by design?

  1. Using differential privacy to add noise to statistical query results. Correct answer.
  2. Sharing personal data widely to increase transparency.
  3. Disabling access controls to simplify data sharing.
  4. Storing all personal data in plain text for easy access.

Explanation

Differential privacy is a PET that allows statistical analysis while limiting the identifiability of individuals. It supports data protection by design by minimizing privacy risks. Plain text storage, broad sharing, and disabling access controls are contrary to privacy by design.

Question 37Fundamental concepts and principles of privacy and data protection

What does the principle of accountability require from an organization processing personal data?

  1. Taking responsibility for complying with data protection principles and being able to demonstrate that compliance. Correct answer.
  2. Publishing the personal data of all employees to show transparency.
  3. Obtaining consent for every processing activity regardless of lawful basis.
  4. Transferring all responsibility to a third-party processor.

Explanation

Accountability means the organization must not only comply with data protection rules but also be able to demonstrate compliance, for example through policies, records, and audits. It does not require publishing personal data or shifting responsibility to processors. Consent is not the only lawful basis.

Question 38Fundamental concepts and principles of privacy and data protection

An organization wants to transfer personal data from the EU to a country without an adequacy decision. Which mechanism is recognized under the GDPR for such transfers?

  1. A unilateral statement by the organization's CEO
  2. Standard contractual clauses approved by the European Commission Correct answer.
  3. Verbal assurances from the recipient
  4. A privacy notice on the organization's website

Explanation

The GDPR allows transfers to third countries based on appropriate safeguards such as standard contractual clauses or binding corporate rules. Verbal assurances, unilateral statements, and privacy notices are not recognized transfer mechanisms. They do not provide the required level of protection.

Question 39Fundamental concepts and principles of privacy and data protection

In the context of ISO/IEC 27701, what is the primary purpose of the PII controller's privacy information management system (PIMS)?

  1. To provide a framework for managing privacy risks and obligations related to PII processing. Correct answer.
  2. To certify that an organization's products are completely anonymous.
  3. To replace all national privacy laws with a single global standard.
  4. To guarantee that no data breaches will ever occur.

Explanation

ISO/IEC 27701 extends ISO/IEC 27001 and 27002 to provide a framework for privacy information management. It helps organizations manage PII risks and comply with privacy obligations. It does not replace laws, guarantee zero breaches, or certify anonymity.

Question 40Fundamental concepts and principles of privacy and data protection

A company uses a third-party cloud service to store customer data. The cloud provider processes data only on the company's instructions. Under ISO/IEC 27701, how should the company classify the cloud provider?

  1. As a PII processor Correct answer.
  2. As a data subject
  3. As a PII controller
  4. As a supervisory authority

Explanation

A PII processor processes personal data on behalf of and on the instructions of a PII controller. The cloud provider does not determine the purposes of processing, so it acts as a processor. The company remains the controller.

Question 41ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

What is the formal title of ISO/IEC 27701:2019?

  1. Information security management - Code of practice for personally identifiable information handling
  2. Information technology - Governance of privacy in public sector organizations
  3. Security techniques - Privacy framework for cloud service providers
  4. Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines Correct answer.

Explanation

ISO/IEC 27701:2019 is titled 'Security techniques - Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management - Requirements and guidelines'. The wording 'Extension' is central because the standard adds privacy-specific requirements on top of the existing ISMS standards rather than replacing them.

Question 42ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

ISO/IEC 27701 is designed as an extension to which pair of standards?

  1. ISO/IEC 27017 and ISO/IEC 27018
  2. ISO/IEC 27001 and ISO/IEC 27002 Correct answer.
  3. ISO/IEC 29100 and ISO/IEC 29134
  4. ISO 31000 and ISO/IEC 27005

Explanation

The standard explicitly extends ISO/IEC 27001 (management system requirements) and ISO/IEC 27002 (information security controls). It layers privacy-specific requirements and guidance onto those two foundations so organizations do not build a separate management system from scratch.

Question 43ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

An organization already certified to ISO/IEC 27001 wants to add privacy information management. How does ISO/IEC 27701 relate to that existing certification?

  1. It replaces the 27001 certificate with a privacy certificate
  2. It automatically certifies the organization without further audit
  3. It is an extension that can be certified alongside the existing ISMS Correct answer.
  4. It is a guidance-only document with no certifiable requirements

Explanation

ISO/IEC 27701 is a certifiable extension to an ISO/IEC 27001 ISMS, so an organization can obtain a 27701 extension certificate that builds on its existing 27001 certification. The two are complementary rather than mutually exclusive.

Question 44ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

In ISO/IEC 27701, which two roles does the standard address with separate control sets?

  1. Auditor and auditee
  2. Developer and operator
  3. PII controller and PII processor Correct answer.
  4. Data subject and supervisory authority

Explanation

The standard provides distinct annexes for organizations acting as PII controllers and as PII processors, because their privacy obligations differ. Identifying which role the organization plays is a prerequisite for selecting the applicable controls.

Question 45ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

Which clause structure does ISO/IEC 27701 use to align with its parent standards?

  1. Clauses that mirror the Annex SL high-level structure and 27001 clause order Correct answer.
  2. A lifecycle model based on the software development process
  3. A flat list of controls without management system clauses
  4. A completely new numbering scheme unrelated to 27001

Explanation

27701 follows the same high-level structure and clause ordering as ISO/IEC 27001, which makes integrated implementation straightforward. Organizations can map privacy requirements onto existing management system clauses such as context, leadership, planning, and support.

Question 46ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

Which statement best describes the scope of ISO/IEC 27701?

  1. It defines privacy principles for governments only
  2. It certifies individual privacy officers
  3. It specifies requirements for products that process personal data
  4. It specifies requirements and guidance for privacy information management within an ISMS Correct answer.

Explanation

The scope covers requirements and guidance for establishing, implementing, maintaining, and continually improving a privacy information management system within the context of an ISMS. It is an organizational management system standard, not a product or personnel certification.

Question 47ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

A company wants to demonstrate privacy compliance to customers. Which combination does an ISO/IEC 27701 certificate actually represent?

  1. A standalone privacy seal unrelated to information security
  2. A legal opinion that the company complies with the GDPR
  3. An ISMS conforming to 27001 plus extended privacy requirements from 27701 Correct answer.
  4. A product conformity mark for software handling PII

Explanation

A 27701 certificate attests that the organization's ISMS meets 27001 requirements and additionally conforms to the privacy extension requirements. It signals a managed, auditable privacy program rather than a legal ruling or product mark.

Question 48ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

How does ISO/IEC 27701 relate to ISO/IEC 27002?

  1. It applies only to 27002 implementations in the public sector
  2. It duplicates 27002 without changes
  3. It extends 27002 by adding privacy-specific guidance and controls Correct answer.
  4. It supersedes 27002 entirely

Explanation

27701 extends 27002 by adding privacy-specific implementation guidance and additional controls, while relying on the security controls already described in 27002. Organizations therefore continue to use 27002 for security controls and layer 27701 privacy guidance on top.

Question 49ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

In the ISO/IEC 27701 annexes, which annex contains privacy-specific controls and guidance for PII controllers?

  1. Annex C
  2. Annex D Correct answer.
  3. Annex A
  4. Annex B

Explanation

Annex D provides privacy-specific controls and guidance for organizations acting as PII controllers, while Annex C addresses PII processors. Annexes A and B contain the 27001 and 27002 extensions respectively.

Question 50ISO/IEC 27701: structure, scope, and relationship with ISO/IEC 27001 and ISO/IEC 27002

What does Annex A of ISO/IEC 27701 contain?

  1. A glossary of privacy terms
  2. Privacy controls for PII processors
  3. The extension to ISO/IEC 27001 management system requirements Correct answer.
  4. The extension to ISO/IEC 27002 guidance

Explanation

Annex A holds the 27701 extension to ISO/IEC 27001, adding privacy-oriented management system requirements to the existing ISMS clauses. The control guidance extensions appear in Annex B.