Fundamental Concepts and Principles of Privacy and Data Protection
This domain tests vocabulary and principles. The exam expects you to separate privacy from data protection, use ISO/IEC 27701's own terms rather than national ones, and connect each principle to a control family later in the standard.
The vocabulary the exam uses
- PII - any information relating to an identified or identifiable PII principal. 27701 deliberately avoids personal data and data subject so the standard stays jurisdiction-neutral.
- PII principal - the natural person the PII relates to.
- PII controller - determines the purposes and means of processing, alone or jointly with others.
- PII processor - processes PII on behalf of, and on the documented instructions of, a controller.
One organisation can hold both roles at once: a payroll provider is a processor for client employee data and a controller for its own staff and marketing list.
Principles behind the controls
Fair information principles underpin Annex A: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. The privacy-by-design family (Clause 7.4 and Annex A) operationalises them: limit collection, limit processing, minimise, de-identify and delete, manage temporary files, set retention.
Pseudonymised data remains PII because re-identification is possible with additional information; only genuinely anonymised data leaves scope. Privacy is the broader right; data protection governs how PII is processed.
Worked example
A company offers an HR analytics tool to clients. For client employee records it is a processor; the client chooses purposes and retention. For its own prospect list it is a controller. Its PIMS scope statement must say which role covers which processing, because controller controls (Annex A) apply to the prospect list and processor controls (Annex B) to the hosted records.
Traps that cost marks
- Assuming consent is always the lawful basis; contract, legal obligation or legitimate interest may apply.
- Calling pseudonymised data anonymous.
- Treating 27701 certification as proof of legal compliance.
- Forgetting accountability requires demonstrable records, not good intentions.